CVE-2026-40565: Freescout Help Desk XSS Vulnerability

CVE-2026-40565 Overview

CVE-2026-40565 is a Cross-Site Scripting (XSS) vulnerability affecting FreeScout, a free self-hosted help desk and shared mailbox application. The vulnerability exists in the linkify() function within app/Misc/Helper.php, which converts plain-text URLs in email bodies into HTML anchor tags without properly escaping double-quote characters (") in the URL. This improper input sanitization allows attackers to break out of the href attribute and inject arbitrary HTML attributes, potentially leading to XSS attacks.

Critical Impact

Attackers can inject malicious HTML attributes into email content viewed by FreeScout users, potentially stealing session cookies, redirecting users to phishing sites, or performing actions on behalf of authenticated users.

Affected Products

• FreeScout versions prior to 1.8.213
• FreeScout self-hosted help desk installations
• FreeScout shared mailbox deployments

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40565 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40565

Vulnerability Analysis

This vulnerability stems from an input validation flaw in how FreeScout processes URLs embedded within email bodies. The application uses HTMLPurifier via the getCleanBody() function to sanitize HTML content, which correctly preserves literal double-quote characters (") in text nodes as part of valid text. However, when the subsequent linkify() function processes these sanitized text nodes to convert URLs into clickable anchor tags, it fails to escape the double-quote characters before embedding them within the href="..." attribute.

This sequence creates a dangerous condition where an attacker can craft a URL containing double-quote characters that, after processing, breaks out of the href attribute boundary. Once outside the attribute context, the attacker can inject arbitrary HTML attributes such as onclick, onmouseover, or other event handlers that execute JavaScript code when triggered by user interaction.

The vulnerability is exploitable over the network and requires user interaction (viewing the malicious email content), but does not require authentication, making it accessible to external attackers who can send emails to the help desk system.

Root Cause

The root cause is improper output encoding in the linkify() function located in app/Misc/Helper.php. While HTMLPurifier correctly handles HTML sanitization for the email body content, the subsequent URL-to-anchor conversion fails to account for special characters that have meaning in HTML attribute contexts. Specifically, the function does not call htmlspecialchars() or equivalent encoding on URL strings before embedding them in the href attribute, allowing double-quote characters to terminate the attribute prematurely.

Attack Vector

The attack is network-based and requires an attacker to send a crafted email to a FreeScout mailbox. The malicious email contains a URL with embedded double-quote characters followed by arbitrary HTML attributes. When a help desk agent or user views the email through FreeScout's web interface, the linkify() function processes the URL and generates malformed HTML that includes the attacker's injected attributes.

The exploitation flow involves the attacker crafting a URL with special characters that escape the href attribute context. When the linkify() function processes text like http://example.com"onclick="alert(1), it wraps this in an anchor tag, but the unescaped double quote terminates the href attribute early, allowing the onclick handler to be injected as a separate attribute. When the victim clicks the malicious link or hovers over it, the injected JavaScript executes in their browser session.

Detection Methods for CVE-2026-40565

Indicators of Compromise

• Unusual email content containing URLs with embedded double-quote characters or HTML attribute patterns
• Web server logs showing requests originating from XSS payload execution
• Session anomalies indicating potential session hijacking after email viewing
• User reports of unexpected browser behavior when viewing help desk tickets

Detection Strategies

• Monitor incoming emails for URLs containing suspicious patterns like "onclick=, "onmouseover=, or similar HTML event handlers
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Review FreeScout application logs for errors related to malformed HTML rendering
• Deploy web application firewall (WAF) rules to detect XSS injection patterns in email content

Monitoring Recommendations

• Enable browser console logging to capture JavaScript errors indicative of XSS attempts
• Configure SentinelOne to monitor for suspicious script execution originating from email viewing contexts
• Set up alerts for unusual outbound connections from user browsers that may indicate data exfiltration
• Monitor for changes to user session tokens or authentication states after email interaction

How to Mitigate CVE-2026-40565

Immediate Actions Required

• Upgrade FreeScout to version 1.8.213 or later immediately
• Review recent help desk tickets for suspicious email content containing unusual URL patterns
• Implement Content Security Policy headers to mitigate potential XSS impact
• Educate help desk staff about the risks of interacting with suspicious email content

Patch Information

FreeScout has addressed this vulnerability in version 1.8.213. The fix ensures that double-quote characters and other special characters are properly escaped before being embedded in HTML attributes within the linkify() function. The patch can be verified through the GitHub Commit Reference. For detailed information about the vulnerability and fix, refer to the GitHub Security Advisory GHSA-49pm-xwqj-vwjp.

Workarounds

• Disable automatic URL linking in email bodies if the feature is configurable in your FreeScout installation
• Implement strict Content Security Policy headers to prevent execution of injected scripts
• Use a web application firewall to filter incoming emails containing suspicious URL patterns
• Consider viewing email content in plain-text mode until the patch can be applied

# Update FreeScout to the patched version
cd /path/to/freescout
git fetch --all
git checkout 1.8.213
php artisan freescout:after-app-update