Stored XSS in FreeScout Help Desk via Mailbox Signature

Executive Summary

CVE-2026-62854 is a stored cross-site scripting (XSS) vulnerability in FreeScout versions before 1.8.225. An authenticated user with permission to edit a mailbox email signature can inject malicious JavaScript into the signature by uploading a scriptable file and bypassing the signature sanitizer using nested script tag fragments. When another user opens the affected mailbox reply editor or new-ticket page, the attacker's script executes with the victim's FreeScout privileges.

Useful 0 Not Useful 0

Detection Guidance

Check FreeScout version with: grep -r "version" /path/to/freescout/config. If version is below 1.8.225, the system is vulnerable. Inspect mailbox signatures for nested script tags or external script references in HTML source.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute malicious scripts in the context of a victim's FreeScout session. The attacker can read visible data and perform actions with the victim's privileges, potentially leading to unauthorized access, data theft, or manipulation of FreeScout functionality.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeScout to version 1.8.225 or later immediately. Review and remove any suspicious mailbox signatures containing script tags or external references. Restrict permissions for editing mailbox signatures to trusted users only.

Useful 0 Not Useful 0