CVE-2026-40565 Details
Description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML attributes. Version 1.8.213 fixes the issue.
A stored cross-site scripting vulnerability has been identified in FreeScout versions prior to 1.8.213. The issue arises in the linkify() function, located in app/Misc/Helper.php, which improperly converts plain-text URLs in email bodies into HTML anchor tags. The function fails to escape double-quote characters in the URLs, allowing for the injection of arbitrary HTML attributes. This vulnerability is compounded by HTMLPurifier, which preserves literal double quotes in text nodes. When the crafted email is viewed by an agent, the injected HTML is executed, leading to a full-page CSS overlay injection or, in some cases, the execution of JavaScript via an onclick attribute.
Users should update to FreeScout version 1.8.213, which addresses this vulnerability by escaping double-quote characters in URLs before they are converted into anchor tags.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freescout freescout | < 1.8.213 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |