CVE-2026-34442CWE-20CWE-601CWE-829

FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

Medium · published March 31, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00320 · 23.7th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-601 · URL Redirection to Untrusted Site ('Open Redirect'); CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-03-31T21:28Z
EPSS history
Timeline
  • 31 MAR 21:28Z
    FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout
    cvelistv5