CVE-2026-34442: FreeScout host header injection in absolute URL generation

CVE-2026-34442 · Severity: medium · CVSS 5.4 · Published 2026-03-31

FreeScout, an open-source help desk and shared inbox platform, is vulnerable to a flaw that allows attackers to manipulate website links and resource locations. By sending a specially crafted request, an attacker can cause the application to generate links that point to malicious websites or load external content from unauthorized servers. This could be used to trick users into visiting phishing sites or to redirect legitimate traffic to attacker-controlled infrastructure, potentially damaging a company's reputation or compromising user credentials.

Technologies: FreeScout Help Desk FreeScout. Vendors: FreeScout Help Desk.

Quick answers

Is CVE-2026-34442 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34442 being exploited in the wild.
How severe is CVE-2026-34442?
Medium severity, with a CVSS score of 5.4, published 31 March 2026.
Which products and versions are affected?
FreeScout Help Desk FreeScout < 1.8.211.
Is there a fix for CVE-2026-34442?
A patch was published on 2026-03-28: Version 1.8.211 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34442 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-34442?
Check whether you run FreeScout Help Desk FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

FreeScout prior to version 1.8.211 fails to properly validate the HTTP Host header when generating absolute URLs for redirects, navigation links, and static assets (such as images and favicons). An unauthenticated remote attacker can manipulate the Host header in a request to inject an arbitrary domain, which the application then reflects in its response (e.g., in the Location header or HTML body). This leads to Open Redirect (CWE-601) and External Resource Loading (CWE-829) vulnerabilities. The issue was addressed by implementing the 'TrustHosts' middleware to restrict the application to authorized hostnames.

Affected products

  • freescout-help-desk FreeScout < 1.8.211

Timeline

  • 2026-03-28: patched: Version 1.8.211 released
  • 2026-03-30: advisory: GitHub Security Advisory published
  • 2026-03-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.