CVE-2026-85743 FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile, Helper::checkPort, Helper::sanitizeRemoteUrl, MailboxesController.php, and ModulesController.php do not consistently enforce a sink-level restricted-host policy. An...