FreeScout anfällig für XSS über Mailbox-Signatur aufgrund unvollständiger HTML-Bereinigung

The XSS vulnerability in FreeScout allows an attacker to inject arbitrary JavaScript code into the mailbox signature displayed to other users. This can be exploited to steal user session cookies, redirect users to malicious websites, or deface the FreeScout interface. Successful exploitation could lead to account takeover, data theft, and further compromise of the system. The lack of robust sanitization of HTML tags and event handlers within the Helper::stripDangerousTags() function is the root cause, enabling the injection of elements like <img>, <svg>, and <details> with malicious event attributes.

Organizations utilizing FreeScout for help desk and shared mailbox management are at risk. This includes businesses of all sizes, particularly those relying on self-hosted deployments. Shared hosting environments where multiple FreeScout instances reside on a single server are especially vulnerable, as a compromise of one instance could potentially impact others.

• wordpress / composer / npm:

grep -r '<script>' /var/www/freescout/app/Http/Controllers/MailboxesController.php
grep -r 'event handler' /var/www/freescout/app/Misc/Helper.php

• generic web:

curl -I http://your-freescout-instance/mailboxes/signatures/new | grep -i content-security-policy

1. 2026-04-21Disclosure

   disclosure

1. Reserviert2026-04-14
2. Veröffentlicht2026-04-21
3. EPSS aktualisiert2026-04-29

The primary mitigation for CVE-2026-40568 is to immediately upgrade FreeScout to version 1.8.213 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious HTML tags or event handlers in the mailbox signature field. Additionally, review and sanitize all user-supplied input within the application, paying close attention to HTML encoding and escaping. Monitor FreeScout logs for unusual activity or attempts to inject malicious code.