FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks
Affects FreeScout versions before 1.8.230, particularly installs that use non-official module updates via latestVersionZipUrl. Fixed in 1.8.230.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 1.8.230
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. FreeScout versions before 1.8.230 (tested on 1.8.229). Non-official module updates that use latestVersionZipUrl. For the redirect bypass, a whitelist entry must allow the original and final redirect hosts, with the restricted host only as an intermediate hop.
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 16/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FreeScout, a self-hosted help desk and shared mailbox application, is affected by a server-side request forgery flaw that lets a privileged logged-in user, such as an administrator, make the server contact loopback and internal services and return their responses into download paths. The bug is reached remotely over the network, but only after the attacker has logged in with high privileges, and it is not exploitable without authentication.
Read the original description
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently enforce a sink-level restricted-host policy. An authenticated administrator, or another authenticated user permitted to change mailbox connection settings or trigger module update or installation paths, can supply attacker-controlled URLs or hosts. The independent download and port-test sinks can reach encoded or otherwise uncovered loopback and internal addresses. The redirect-validation bypass additionally requires a configured whitelist that permits the original and final hosts while a restricted internal host appears only as an intermediate redirect hop. No unauthenticated SSRF path is established. The server can consequently contact loopback and internal services, provide a blind internal port oracle, and retrieve internal HTTP responses into application-controlled download sinks. This issue is fixed in version 1.8.230.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.2/10CVSS 8.2
- No patch0/5No signal
What would change the score
- Would score about 66 if added to CISA KEV
- Would score about 61 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
FreeScout versions before 1.8.230 (tested on 1.8.229). Non-official module updates that use latestVersionZipUrl. For the redirect bypass, a whitelist entry must allow the original and final redirect hosts, with the restricted host only as an intermediate hop.Upgrade to a fixed version: 1.8.230.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- freescout-help-desk freescout
fixed in 1.8.230
Evidence 4
- Advisory
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-85743
Is CVE-2026-85743 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The application server can be induced to connect to loopback and internal network addresses. This can reveal which internal ports are open and can pull internal HTTP responses into download functions. Redirect checks can also be bypassed.Source: github.com
Which versions are affected by CVE-2026-85743?
freescout: before 1.8.230.Source: cve.now feed data
Am I affected, and how do I check?
Versions before 1.8.230 are affected, and the advisory tested 1.8.229. The redirect bypass additionally needs a whitelist entry that allows both the original and final redirect hosts. To check, confirm your installed FreeScout version and whether you use non-official module updates that rely on latestVersionZipUrl.Source: github.com
How do I fix CVE-2026-85743?
Upgrade FreeScout to 1.8.230 or later, which contains the fix.Source: github.com
Why do the sources disagree?
The description says the issue can be reached without authentication, but the CVSS vector lists PR:H, meaning high privileges are required. The sources conflict on the required access level, and this page does not resolve which is correct.Source: github.com