Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M

CVE-2026-107393FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

Medium 6.1

In plain English

A medium-severity cross-site scripting in freescout from freescout-help-desk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue is fixed in version 1.8.235.

Affected products (as reported)

Vendor	Product	Versions
freescout-help-desk	freescout	< 1.8.235

Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4 x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/0f41f5cabb581de156ec8eb344ff6c0e6e0cc66a x_refsource_MISC
https://github.com/freescout-help-desk/freescout/releases/tag/1.8.235 x_refsource_MISC