CVE-2026-107393CWE-116CWE-79cross-site-scripting

CVE-2026-107393

Medium · published October 9, 2026

CVSS v3.1

6.1

EPSS

Percentile

7.9

In the wild

Unconfirmed

What it is

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue is fixed in version 1.8.235.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00187 · 7.9th percentile
Weaknesses: CWE-116 · Improper Encoding or Escaping of Output; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-10-09T00:17Z

References (4)

https://github.com/freescout-help-desk/freescout/commit/0f41f5cabb581de156ec8eb344ff6c0e6e0cc66a · [email protected]https://github.com/freescout-help-desk/freescout/releases/tag/1.8.235 · [email protected]https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4 · [email protected]https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

10 OCT 03:27Z
EPSS moved — → 0%
epss
08 OCT 19:52Z
FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header
cvelistv5
08 OCT 19:52Z
FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header
cvelistv5