# CVE-2026-34442: FreeScout host header injection in absolute URL generation

Source: https://junglewise.ai/threats/cve-2026-34442-freescout-host-header-injection-in-absolute-url-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34442 · Severity: medium · CVSS 5.4 · Published 2026-03-31

FreeScout, an open-source help desk and shared inbox platform, is vulnerable to a flaw that allows attackers to manipulate website links and resource locations. By sending a specially crafted request, an attacker can cause the application to generate links that point to malicious websites or load external content from unauthorized servers. This could be used to trick users into visiting phishing sites or to redirect legitimate traffic to attacker-controlled infrastructure, potentially damaging a company's reputation or compromising user credentials.

Technologies: [FreeScout Help Desk FreeScout](https://junglewise.ai/threats/technologies/freescout). Vendors: [FreeScout Help Desk](https://junglewise.ai/threats/vendors/freescout-help-desk).

## Quick answers

**Is CVE-2026-34442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34442 being exploited in the wild.

**How severe is CVE-2026-34442?** Medium severity, with a CVSS score of 5.4, published 31 March 2026.

**Which products and versions are affected?** FreeScout Help Desk FreeScout < 1.8.211.

**Is there a fix for CVE-2026-34442?** A patch was published on 2026-03-28: Version 1.8.211 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34442 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-34442?** Check whether you run FreeScout Help Desk FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

FreeScout prior to version 1.8.211 fails to properly validate the HTTP Host header when generating absolute URLs for redirects, navigation links, and static assets (such as images and favicons). An unauthenticated remote attacker can manipulate the Host header in a request to inject an arbitrary domain, which the application then reflects in its response (e.g., in the Location header or HTML body). This leads to Open Redirect (CWE-601) and External Resource Loading (CWE-829) vulnerabilities. The issue was addressed by implementing the 'TrustHosts' middleware to restrict the application to authorized hostnames.

## Affected products

- freescout-help-desk FreeScout < 1.8.211

## Timeline

- 2026-03-28: patched: Version 1.8.211 released
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD

## References

- [https://github.com/freescout-help-desk/freescout/commit/889d75c8e3c15e6a7ddb6a4d4f65cc0379c29213](https://github.com/freescout-help-desk/freescout/commit/889d75c8e3c15e6a7ddb6a4d4f65cc0379c29213)
- [https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211](https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211)
- [https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xj](https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xj)

## Related threats

- [FreeScout missing authorization in internal note deletion](https://junglewise.ai/threats/cve-2026-48811-freescout-missing-authorization-in-internal-note-deletion)
- [FreeScout improper authorization in ThreadPolicy edit method](https://junglewise.ai/threats/cve-2026-48810-freescout-improper-authorization-in-threadpolicy-edit-method)
- [FreeScout agent impersonation via missing HMAC in notification replies](https://junglewise.ai/threats/cve-2026-47123-freescout-agent-impersonation-via-missing-hmac-in-notification)
- [FreeScout account enumeration in password reset endpoint](https://junglewise.ai/threats/cve-2026-45294-freescout-account-enumeration-in-password-reset-endpoint)
- [FreeScout SSRF via broken CIDR check in checkIpByMask](https://junglewise.ai/threats/cve-2026-34443-freescout-ssrf-via-broken-cidr-check-in-checkipbymask)