freescout-help-desk FreeScout up to 1.8.229 Redirect Validation MailboxesController.php sanitizeRemoteUrl server-side request forgery

Summaryinfo

A vulnerability classified as problematic has been found in freescout-help-desk FreeScout up to 1.8.229. This vulnerability affects the function Helper::downloadRemoteFile/Helper::checkPort/Helper::sanitizeRemoteUrl of the file MailboxesController.php of the component Redirect Validation. Performing a manipulation results in server-side request forgery. This vulnerability is cataloged as CVE-2026-85743. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in freescout-help-desk FreeScout up to 1.8.229. This affects the function Helper::downloadRemoteFile/Helper::checkPort/Helper::sanitizeRemoteUrl of the file MailboxesController.php of the component Redirect Validation. The manipulation with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently enforce a sink-level restricted-host policy. An authenticated administrator, or another authenticated user permitted to change mailbox connection settings or trigger module update or installation paths, can supply attacker-controlled URLs or hosts. The independent download and port-test sinks can reach encoded or otherwise uncovered loopback and internal addresses. The redirect-validation bypass additionally requires a configured whitelist that permits the original and final hosts while a restricted internal host appears only as an intermediate redirect hop. No unauthenticated SSRF path is established. The server can consequently contact loopback and internal services, provide a blind internal port oracle, and retrieve internal HTTP responses into application-controlled download sinks. This issue is fixed in version 1.8.230.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-85743 since 09/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:MailboxesController.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.8.230 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• freescout-help-desk

Name

• FreeScout

Version

• 1.8.229

Website

• Product: https://github.com/freescout-help-desk/freescout/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion