FreeScout: Stored XSS in mailbox signature via same-origin JS upload
Affects FreeScout 1.8.224 and earlier releases in the affected range, where users who can edit a mailbox signature can plant script that runs for others. Fixed in 1.8.226.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 1.8.225
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. FreeScout version 1.8.224 (earlier releases in the affected range). Attacker must be able to edit the mailbox signature (administrator, or a user with mailbox-scoped Email Signature permission). Victim must be an authenticated FreeScout user or administrator who opens the affected mailbox reply editor or new-ticket page after the malicious signature is saved.
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 16/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FreeScout, a self-hosted help desk and shared mailbox tool, has a stored cross-site scripting flaw in mailbox signatures that lets a remote attacker with a low-privilege login plant a script. The script runs when another user opens the affected mailbox's reply editor or new-ticket page, where it can read visible data and perform actions with that user's privileges.
Read the original description
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout privileges and can read visible data and perform same-origin actions. This issue is fixed in version 1.8.225.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.6/10CVSS 7.6
- No patch0/5No signal
What would change the score
- Would score about 66 if added to CISA KEV
- Would score about 61 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
FreeScout version 1.8.224 (earlier releases in the affected range). Attacker must be able to edit the mailbox signature (administrator, or a user with mailbox-scoped Email Signature permission). Victim must be an authenticated FreeScout user or administrator who opens the affected mailbox reply editor or new-ticket page after the malicious signature is saved.Upgrade to a fixed version: 1.8.225.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- freescout-help-desk freescout
fixed in 1.8.225
Evidence 4
- Advisory
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-62854
Is CVE-2026-62854 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A user who can edit a mailbox email signature can save JavaScript into it. When another logged-in FreeScout user or administrator opens that mailbox's reply editor or new-ticket page, the script runs in their session. It can read data visible on the page and perform same-origin actions with that user's privileges.Source: github.com
Which versions are affected by CVE-2026-62854?
freescout: before 1.8.225.Source: cve.now feed data
Am I affected, and how do I check?
Releases 1.8.224 and earlier in the affected range are involved. The bug needs someone who can edit the mailbox signature, either an administrator or a user with the mailbox-scoped Email Signature permission, and a logged-in user who opens that mailbox's reply editor or new-ticket page after the signature is saved. To check a installation, look at the installed FreeScout version.Source: github.com
How do I fix CVE-2026-62854?
Upgrade FreeScout to 1.8.226, the patched version listed in the advisory.Source: github.com