What is the CVSS score of CVE-2026-40565?

CVE-2026-40565 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40565?

Yes, a patch is available for CVE-2026-40565. Update the affected software to the latest version immediately.

FreeScout CVE-2026-40565

EUVD-2026-24141 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-21 GitHub_M

XSS PHP

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 22, 2026 - 17:34 nvd

Patch available

Apr 21, 2026 - 17:01 EUVD

Analysis Generated

Apr 21, 2026 - 16:32 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 16:00 euvd

EUVD-2026-24141

Analysis Generated

Apr 21, 2026 - 16:00 vuln.today

CVE Published

Apr 21, 2026 - 15:52 nvd

MEDIUM 6.1

DescriptionGitHub Advisory

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML attributes. Version 1.8.213 fixes the issue.

AnalysisAI

Stored cross-site scripting (XSS) in FreeScout prior to version 1.8.213 allows remote attackers to inject arbitrary HTML attributes into email message bodies by embedding unescaped double-quote characters in URLs. When the linkify() function converts plain-text URLs to anchor tags without proper escaping, attackers can break out of the href attribute and inject malicious JavaScript or event handlers. This requires user interaction (UI:R) to view a crafted email, but once viewed, the injected script executes in the context of the victim's session with potential for account compromise or data theft.

Technical ContextAI

FreeScout is a self-hosted PHP-based help desk application that processes inbound email messages. The vulnerability exists in the linkify() function (app/Misc/Helper.php), which converts plain-text URL strings into HTML anchor elements for rendering in email threads. The function is called after HTMLPurifier sanitization via getCleanBody(). HTMLPurifier preserves literal double-quote (" or ") characters when they appear in text content, treating them as benign literal text rather than HTML syntax. The linkify() function then wraps these URLs-including any embedded quote characters-into an unescaped href="..." attribute structure, allowing an attacker to terminate the href value prematurely and inject new HTML attributes such as onmouseover, onclick, or style. This is a classic reflected/stored XSS via improper output encoding (CWE-79), exacerbated by incomplete HTML entity escaping of URL values before embedding them into attribute context.

RemediationAI

Upgrade FreeScout to version 1.8.213 or later. This is the primary remediation and addresses the root cause by properly escaping double-quote characters in URLs before embedding them into HTML href attributes. For organizations unable to upgrade immediately, apply the specific code fix from commit 265379b3ae343f06846adc0aa8510643d1eac2df (available at https://github.com/freescout-help-desk/freescout/commit/265379b3ae343f06846adc0aa8510643d1eac2df), which modifies the linkify() function in app/Misc/Helper.php to use HTML entity encoding (e.g., htmlspecialchars() with ENT_QUOTES flag) on URL values before insertion into href attributes. As a compensating control, restrict email submission to FreeScout to authenticated internal users only and disable external mail integration if feasible; this reduces the attack surface to insider threats but may impact help desk workflow. Additionally, enable and configure Content Security Policy (CSP) headers with script-src 'self' and object-src 'none' to limit the impact of any injected JavaScript, though this does not prevent the vulnerability itself and may require testing for application compatibility.