Executive Summary

CVE-2026-40567 is a moderate severity HTML injection vulnerability in FreeScout versions prior to 1.8.213. An unauthenticated attacker can exploit this by sending an email with a crafted From display name containing arbitrary HTML. This crafted name is stored in the database without sanitization and later rendered unescaped in outgoing reply emails via the `{%customer.fullName%}` signature variable.

Because the injected HTML is not properly escaped, attackers can embed phishing links, tracking pixels, and spoofed content inside legitimate support emails sent from the organization's address. Although JavaScript execution is blocked by modern email clients, the HTML injection still allows malicious content to appear in trusted emails.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to inject malicious HTML into legitimate support emails sent from your organization's FreeScout help desk. This can lead to:

• Embedding phishing links that can trick recipients into revealing sensitive information.
• Including tracking pixels to monitor email recipients without their consent.
• Spoofing content within trusted emails, potentially damaging your organization's reputation and trustworthiness.

Since the attack requires no authentication and no user interaction, it poses a significant risk of delivering malicious content through emails that appear legitimate.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring incoming emails to your FreeScout system for suspicious or crafted From display names containing HTML tags. Since the vulnerability involves injection of arbitrary HTML via the From display name, inspecting the raw email headers for unexpected HTML content is a key detection method.

You can use commands to fetch and inspect emails on the mail server or within FreeScout's email storage to identify From headers with HTML tags such as <a> or <img>.

• Use command-line tools like `grep` or `sed` to search for HTML tags in the From header of emails, for example: `grep -i -r 'From:.*<a ' /path/to/maildir`
• Use IMAP clients or scripts to fetch emails and parse the From display name for HTML content.
• Check FreeScout database entries for customer names containing HTML tags by querying the relevant tables storing customer first and last names.

Additionally, reviewing outgoing emails for injected HTML in signatures (via the `{%customer.fullName%}` variable) can help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade FreeScout to version 1.8.213 or later, where this vulnerability has been fixed.

The fix involves properly escaping or sanitizing customer names before rendering them in outgoing email signatures to prevent HTML injection.

• Modify the email signature rendering code to enable escaping by changing the call in `reply_fancy.blade.php` to pass `$escape = true`.
• Apply `htmlspecialchars()` or equivalent escaping functions in the code path that processes customer names before output.
• Ensure that input sanitization is applied when storing customer names, stripping dangerous HTML tags.

If immediate upgrade is not possible, consider implementing email filtering rules to block or quarantine emails with suspicious From display names containing HTML.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an unauthenticated attacker to inject arbitrary HTML into outgoing emails sent from the organization's address, embedding phishing links, tracking pixels, and spoofed content. This can lead to phishing attacks and unauthorized tracking of email recipients.

Such exploitation could potentially impact compliance with standards and regulations like GDPR and HIPAA, which require organizations to protect personal data and ensure secure communication channels. The injection of malicious content into legitimate emails may lead to unauthorized disclosure or misuse of personal information, undermining data integrity and confidentiality obligations.

However, the provided context and resources do not explicitly discuss the direct impact of this vulnerability on compliance with GDPR, HIPAA, or other common standards.

Useful 0 Not Useful 0