CVE-2026-41905highCWE-918

CVE-2026-41905: falha de alta gravidade em freescout-help-desk freescout

FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access

Publicada em

Seguir esta CVE+ Monitorar freescout

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.2%
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl() in app/Misc/Helper.php follows HTTP redirects via curlGetLastRedirectedUrl() but then re-validates the original URL instead of the final redirect destination. An attacker who can supply any URL that passes the initial host check can redirect FreeScout to internal HTTP services (cloud metadata, internal APIs, RFC1918 ranges) that would normally be blocked. This issue has been patched in version 1.8.217.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
freescout-help-desk · freescout
CVEs relacionadas — freescout-help-desk freescout

No mesmo produto, das mais perigosas para as menos.

CVE-2026-28289CRITICALFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionEPSS 35.1%CVE-2026-27636HIGHFreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on ApacheEPSS 2.2%CVE-2026-53595CRITICALFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLEPSS 1.9%CVE-2025-48471HIGHFreeScout Vulnerable to Arbitrary File UploadEPSS 1.2%CVE-2025-54366HIGHFreeScout's deserialization of untrusted data leads to Remote Code ExecutionEPSS 1.1%CVE-2025-48389HIGHFreeScout Vulnerable to Deserialization of Untrusted DataEPSS 1.0%