CVE-2026-40565
mediumpriority · track · 0EPSS 0.002 · 10 %ileEUUSEPSS · scored 2026-10-28
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML attributes. Version 1.8.213 fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://freescout.net/Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-40565cnnvd
- https://github.com/freescout-help-desk/freescout/commit/265379b3ae343f06846adc0aa8510643d1eac2dfenisa_euvd
- https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213enisa_euvd
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-49pm-xwqj-vwjpenisa_euvd
- https://github.com/freescout-help-desk/freescout/commit/265379b3ae343f06846adc0aa8510643d1eac2dfPatchnvd
- https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213Release Notesnvd
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-49pm-xwqj-vwjpVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan