CVE-2026-62854 FreeScout: Stored XSS in mailbox signature via same-origin JS upload

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags. The resulting external script is served from the same...

CVE-2026-62854 FreeScout: Stored XSS in mailbox signature via same-origin JS upload

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags. The resulting external script is served from the same...

CVE-2026-62854

FreeScout, a self-hosted help desk and shared mailbox, is vulnerable to Stored XSS in the mailbox signature prior to version 1.8.225 . An attacker with mailbox signature editing privileges can bypass the Helper::stripDangerousTags() function by combining scriptable files uploaded via /uploads/upl...