CVE-2026-73531

Received Received - Intake

Stored XSS in django-helpdesk via Email Attachments

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can exploit the lack of sanitization and Content-Disposition headers at the attachment-serving layer to execute malicious scripts in the browser session of authenticated staff members who open the attachment while triaging tickets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73531

EUVD

EUVD-2026-58243

Affected Vendors & Products

Vendor	Product	Version / Range
django-helpdesk	django-helpdesk	to 2.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in django-helpdesk versions before 2.3.3. Attackers can inject malicious JavaScript by submitting HTML-formatted emails or uploading .html/.htm files through public ticket channels. The application fails to sanitize these inputs, allowing scripts to execute when staff members open attachments while reviewing tickets.

Detection Guidance

Check for unauthorized .html or .htm attachments in tickets by searching for files with these extensions in your django-helpdesk storage. Review server logs for requests to attachment endpoints with suspicious User-Agent strings or payloads containing script tags. Inspect email bodies saved as HTML attachments for unfiltered JavaScript code.

Impact Analysis

Unauthenticated attackers can execute malicious scripts in the browser sessions of authenticated staff members. This may lead to session hijacking, unauthorized actions, or data theft. Staff with access to tickets and queues are particularly at risk as they handle sensitive information.

Mitigation Strategies

Upgrade django-helpdesk to version 2.3.3 or later. Remove .html and .htm from the attachment allowlist. Configure your web server to serve these files with Content-Disposition: attachment headers. Audit existing tickets for .html/.htm attachments and delete them. Implement input sanitization for all user-submitted HTML content.

Hi! I’m here to help you understand CVE-2026-73531. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70