CVE-2026-32753
Stored XSS via SVG Upload Bypass in FreeScout
Publication date: 2026-03-19
Last updated on: 2026-03-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freescout | freescout | to 1.8.209 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FreeScout versions 1.8.208 and below, where attackers can bypass the attachment view logic and SVG sanitizer to upload and render an SVG file containing malicious JavaScript.
The application restricts inline rendering of uploaded files based on file extension and declared Content-Type. However, an attacker can upload a file with a safe extension like .png but with a Content-Type of image/svg+xml, causing the server to treat it as a safe image and render it inline.
Because SVG files can contain scripted behavior, this allows an attacker to execute cross-site scripting (XSS) attacks. Any authenticated user can create a URL that, when visited by another user or administrator, executes malicious actions on their behalf.
This issue was fixed in FreeScout version 1.8.209.
How can this vulnerability impact me? :
This vulnerability can lead to cross-site scripting (XSS) attacks, allowing attackers to execute malicious JavaScript in the context of the victim's browser.
As a result, attackers can perform actions on behalf of other users or administrators, potentially leading to unauthorized access, data theft, or manipulation of the application.
Since any authenticated user can exploit this vulnerability, it increases the risk of insider threats or compromised accounts being used to launch attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in FreeScout versions 1.8.208 and below allows authenticated users to upload SVG files disguised with a .png extension and a content type of image/svg+xml, enabling malicious JavaScript execution.
To mitigate this vulnerability immediately, upgrade FreeScout to version 1.8.209 or later, where the issue has been fixed.