Is there a patch available for CVE-2026-34443?

Yes, a patch is available for CVE-2026-34443. Update the affected software to the latest version immediately.

PHP CVE-2026-34443

Q: What is the CVSS score of CVE-2026-34443?

CVE-2026-34443 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17674 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-31 GitHub_M

PHP SSRF

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.211

EUVD ID Assigned

Mar 31, 2026 - 21:46 euvd

EUVD-2026-17674

Analysis Generated

Mar 31, 2026 - 21:46 vuln.today

CVE Published

Mar 31, 2026 - 21:28 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask() in app/Misc/Helper.php checks whether the input IP contains a / character. Plain IP addresses never contain /, so the function always returns false without checking any CIDR ranges. The entire 10.0.0.0/8 and 172.16.0.0/12 private ranges are unprotected. This issue has been patched in version 1.8.211.

AnalysisAI

FreeScout prior to version 1.8.211 fails to validate Server-Side Request Forgery (SSRF) protections due to a flawed IP range check in checkIpByMask() that only accepts CIDR notation and rejects plain IP addresses, leaving the entire 10.0.0.0/8 and 172.16.0.0/12 private IP ranges unprotected from SSRF attacks. Remote attackers can exploit this logic error to access internal services and resources on private networks that the application can reach, potentially escalating to information disclosure or further lateral movement. The vulnerability is confirmed patched in version 1.8.211.

Technical ContextAI

FreeScout is a PHP-based help desk application built on Laravel. The vulnerability exists in the checkIpByMask() function in app/Misc/Helper.php, which is responsible for validating whether a given IP address falls within protected CIDR ranges to prevent SSRF attacks. The function contains a type-checking defect (CWE-918: Server-Side Request Forgery) where it validates input by checking for the presence of a forward slash (/) character-a requirement of CIDR notation-and immediately returns false if the slash is absent. Since legitimate private IP addresses (e.g., 10.5.2.1, 172.16.0.50) do not contain slashes, the function fails to validate them against known-dangerous private ranges, leaving large swaths of RFC 1918 address space (10.0.0.0/8 and 172.16.0.0/12) accessible to SSRF exploitation. The affected product is identified by CPE a:freescout-help-desk:freescout with versions prior to 1.8.211.

RemediationAI

Vendor-released patch: FreeScout 1.8.211 and later. Upgrade immediately to version 1.8.211 or any subsequent release. The upstream fix is available in commit ca6d5bb572d3e8f52a0e654a8623a53cb0fdd580 (https://github.com/freescout-help-desk/freescout/commit/ca6d5bb572d3e8f52a0e654a8623a53cb0fdd580) and tagged in release 1.8.211 (https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211). No workarounds are documented; patching is the primary and recommended remediation. If immediate patching is not possible, consider network-level restrictions to limit the application's ability to reach internal IP ranges via firewall rules or egress filtering.