CVE-2026-107393: FreeScout Help Desk XSS Vulnerability

CVE-2026-107393 Overview

CVE-2026-107393 is a stored cross-site scripting (XSS) vulnerability in FreeScout, a self-hosted help desk and shared mailbox application. The flaw affects versions prior to 1.8.235 when the APP_CLOUDFLARE_IS_USED configuration flag is enabled. FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and persists the spoofed value in the activity log. The LogsMonitor component later inserts the attacker-controlled value into an administrator alert email without HTML escaping. When an administrator opens the email, injected HTML executes in their mail client context [CWE-79].

Critical Impact
Unauthenticated attackers can inject HTML into administrator alert emails by spoofing the CF-Connecting-IP header on failed logins, executing content when administrators view the alert.

Affected Products

FreeScout help desk versions prior to 1.8.235
Deployments with APP_CLOUDFLARE_IS_USED enabled
The LogsMonitor console command and the overridden Symfony Request component

Discovery Timeline

2026-10-08 - CVE CVE-2026-107393 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107393

Vulnerability Analysis

The vulnerability chains two weaknesses. First, the overridden Symfony Request class accepts the HTTP_CF_CONNECTING_IP header and overwrites REMOTE_ADDR without validating that the header value is a well-formed IP address. Second, the LogsMonitor console command composes administrator alert emails by concatenating log properties directly into HTML without calling htmlspecialchars. Because failed login events include the client IP in the activity log, an unauthenticated attacker can store arbitrary HTML in that field by sending malformed CF-Connecting-IP values during login attempts. The payload activates when LogsMonitor dispatches its periodic alert and an administrator opens the resulting message.

Root Cause

Two defects combine: missing input validation on a client-controlled HTTP header and missing output encoding when log data is rendered into an HTML email body. User interaction is required because the payload only executes when the administrator opens the alert email.

Attack Vector

The attack is network-based and does not require authentication. An attacker submits failed login requests to a FreeScout instance that trusts the CF-Connecting-IP header. By placing HTML or script markup in that header, the attacker causes the spoofed value to be recorded in the activity log and later embedded, unescaped, into the next administrator alert email.

php

// Patch in overrides/symfony/http-foundation/Request.php
// Validates the Cloudflare client IP header before trusting it.
if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])
    && $_SERVER['REMOTE_ADDR'] != $_SERVER["HTTP_CF_CONNECTING_IP"]
    && config('app.cloudflare_is_used')
    // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4
    && \Helper::isValidIp($_SERVER["HTTP_CF_CONNECTING_IP"])
) {
    $_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
    $this->server->set('REMOTE_ADDR', $_SERVER["HTTP_CF_CONNECTING_IP"]);
}

Source: GitHub Commit 0f41f5c

Detection Methods for CVE-2026-107393

Indicators of Compromise

Entries in the FreeScout activity log where the client IP field contains HTML tags, angle brackets, or javascript: URIs instead of a valid IPv4 or IPv6 address.
Outbound administrator alert emails from the LogsMonitor command containing unexpected <script>, <img>, or anchor tags inside log entry sections.
Spikes in failed login events originating from a single source with malformed CF-Connecting-IP headers.

Detection Strategies

Inspect web server access logs for CF-Connecting-IP header values that fail IP validation, particularly those containing <, >, or &# sequences.
Query the FreeScout database activity_log table for rows whose stored IP or properties columns do not match a valid IP regular expression.
Review outbound mail queues for messages generated by app/Console/Commands/LogsMonitor.php and flag any containing raw HTML in log description fields.

Monitoring Recommendations

Alert on any failed authentication event where the recorded source address is not RFC-compliant.
Monitor the FreeScout host for scheduled executions of the logs:monitor command and capture the content of generated emails for review.
Correlate repeated failed logins carrying non-standard header values with subsequent administrator email access.

How to Mitigate CVE-2026-107393

Immediate Actions Required

Upgrade FreeScout to version 1.8.235 or later, which adds IP validation and htmlspecialchars output encoding.
Audit the activity_log table for existing poisoned entries and purge any records containing HTML in IP fields before administrators open pending alert emails.
If upgrade is not immediate, disable the APP_CLOUDFLARE_IS_USED setting to stop FreeScout from trusting the CF-Connecting-IP header.

Patch Information

The fix is delivered in FreeScout release 1.8.235 via commit 0f41f5cabb581de156ec8eb344ff6c0e6e0cc66a. The patch validates HTTP_CF_CONNECTING_IP with \Helper::isValidIp() before overwriting REMOTE_ADDR and wraps log name, event description, and properties in htmlspecialchars() inside LogsMonitor. Full details are in GHSA-9cm3-qvj2-8hg4.

Workarounds

Place FreeScout behind a reverse proxy that strips or overwrites inbound CF-Connecting-IP headers from untrusted sources.
Restrict ingress to FreeScout so that only Cloudflare source ranges can reach the application, preventing direct header spoofing.
Instruct administrators to view LogsMonitor alerts in a plaintext mail client until the upgrade is applied.

bash

# Upgrade FreeScout to the fixed release
cd /var/www/freescout
git fetch --tags
git checkout 1.8.235
php artisan freescout:after-app-update

# Temporary mitigation: disable Cloudflare header trust in .env
sed -i 's/^APP_CLOUDFLARE_IS_USED=.*/APP_CLOUDFLARE_IS_USED=false/' .env
php artisan config:clear