CVE-2026-34442

Katalog CVE

CVSS 6.1 · Medium EPSS 0,32%

Kerentanan Improper Input Validation pada freescout. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xj exploit · advisory vendor
• https://github.com/freescout-help-desk/freescout/commit/889d75c8e3c15e6a7ddb6a4d4f65cc0379c29213 patch
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211 release notes