CVE-2026-34442

FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

State: Published
Severity: 5.4 Medium
Published: Mar 31, 2026
Updated: Apr 1, 2026
Reserved: Mar 27, 2026

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Affected Products

Product	Versions
freescoutfreescout-help-desk	< 1.8.211Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.