CVE-2026-34443 Details

A server-side request forgery (SSRF) vulnerability has been identified in FreeScout versions prior to 1.8.211. The issue arises in the 'checkIpByMask()' function within 'app/Misc/Helper.php', where the function incorrectly validates IP addresses. It only checks for the presence of a '/' character, which means plain IP addresses are always deemed invalid. As a result, the function fails to recognize CIDR ranges, leaving the entire 10.0.0.0/8 and 172.16.0.0/12 private IP ranges unprotected. This vulnerability can be exploited by crafting an email with a remote attachment URL that points to an internal API, bypassing the CIDR check and potentially leading to unauthorized access or actions on the server.

Users should update FreeScout to version 1.8.211 or later, where this vulnerability has been patched.