# CVE-2026-85743: FreeScout SSRF in remote download and port check

Source: https://junglewise.ai/threats/cve-2026-85743-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-85743 · Severity: high · CVSS 8.2 · Published 2026-11-06

FreeScout is a self-hosted help desk and shared mailbox platform. An authenticated administrator or user with mailbox or module management permissions can bypass internal host restrictions to reach loopback and internal network services, retrieve sensitive internal responses, or map internal ports. This allows attackers with these privileges to probe internal infrastructure and potentially exfiltrate data from services only accessible internally.

Technologies: [FreeScout](https://junglewise.ai/threats/technologies/freescout-freescout). Vendors: [FreeScout](https://junglewise.ai/threats/vendors/freescout).

## Quick answers

**Is CVE-2026-85743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85743 being exploited in the wild.

**How severe is CVE-2026-85743?** High severity, with a CVSS score of 8.2, published 6 November 2026.

**Which products and versions are affected?** FreeScout before 1.8.230.

**Is there a fix for CVE-2026-85743?** Yes: fixed in 1.8.230. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85743 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85743?** Check whether you run FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.8.230

## Technical details

Server-Side Request Forgery (SSRF) exists in multiple code paths (Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, ModulesController.php) that do not consistently enforce restricted-host validation. Authenticated users can supply crafted URLs to bypass restrictions via encoding and redirect chains, allowing contact with loopback/internal addresses. Requires authentication and specific user roles (mailbox/module management).

## Affected products

- FreeScout FreeScout before 1.8.230

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/freescout-help-desk/freescout/commit/09799fd4bcf731704bc2099a87bca0cf18d20acb](https://github.com/freescout-help-desk/freescout/commit/09799fd4bcf731704bc2099a87bca0cf18d20acb)
- [https://github.com/freescout-help-desk/freescout/commit/a4c587cf1fff87eae7d3e4f297fa4cc81ba28704](https://github.com/freescout-help-desk/freescout/commit/a4c587cf1fff87eae7d3e4f297fa4cc81ba28704)

## Related threats

- [FreeScout stored XSS in job details page](https://junglewise.ai/threats/cve-2026-85742-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to)
- [FreeScout authorization bypass in conversation merge](https://junglewise.ai/threats/cve-2026-85744-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to)
- [FreeScout SQL injection in polycast receive endpoint](https://junglewise.ai/threats/cve-2026-62856-freescout-is-a-self-hosted-help-desk-and-shared-mailbox)
- [FreeScout path traversal in App Logs viewer](https://junglewise.ai/threats/cve-2026-62855-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to)
- [FreeScout stored XSS in mailbox signature via nested tag bypass](https://junglewise.ai/threats/cve-2026-62854-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to)