freescout-help-desk freescout up to 1.8.216 HTTP Service app/Misc/Helper.php sanitizeRemoteUrl server-side request forgery

Summaryinfo

A vulnerability classified as critical was found in freescout-help-desk freescout up to 1.8.216. The affected element is the function Helper::sanitizeRemoteUrl of the file app/Misc/Helper.php of the component HTTP Service. Such manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-41905. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in freescout-help-desk freescout up to 1.8.216. Affected by this issue is the function Helper::sanitizeRemoteUrl of the file app/Misc/Helper.php of the component HTTP Service. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl() in app/Misc/Helper.php follows HTTP redirects via curlGetLastRedirectedUrl() but then re-validates the original URL instead of the final redirect destination. An attacker who can supply any URL that passes the initial host check can redirect FreeScout to internal HTTP services (cloud metadata, internal APIs, RFC1918 ranges) that would normally be blocked. This issue has been patched in version 1.8.217.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-41905 since 04/22/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

By approaching the search of inurl:app/Misc/Helper.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.8.217 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• freescout-help-desk

Name

• freescout

Version

• 1.8.216

Website

• Product: https://github.com/freescout-help-desk/freescout/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion