What’s Vulnerable › Vulnerabilities

CVE-2026-34442: FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-31 · updated 2026-07-24
• Weakness: CWE-20

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.

Affected products

• freescout-help-desk freescout: before 1.8.211 — fixed in 1.8.211

How to fix

Upgrade to a fixed version: freescout-help-desk freescout 1.8.211. Check the vendor advisory for mitigations.

References

• https://github.com/freescout-help-desk/freescout/commit/889d75c8e3c15e6a7ddb6a4d4f65cc0379c29213
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xj
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xj

Get alerted when CVE-2026-34442 or the next vulnerability affects your stack