django-helpdesk CVE-2026-73531

Injection of the malicious payload requires no authentication - the public ticket submission endpoint is open to any internet user by default and accepts both HTML-formatted email bodies and .html/.htm file attachments. Triggering the stored XSS payload requires an authenticated staff member to open the malicious attachment in their browser while logged into the helpdesk application; this user interaction (UI:P) is a normal part of the ticket triage workflow and should not be considered a strong defensive barrier. Specific enabling conditions are: (1) the public-facing ticket submission channel must be reachable, which is the default deployment posture; (2) the attachment-serving endpoint must deliver .html/.htm files without a Content-Disposition: attachment header, which is the unpatched default behavior; and (3) an authenticated staff user must open the attachment in a browser session. Exploitation is constrained by the requirement for staff interaction and does not affect systems where .html/.htm attachments are blocked at the email gateway or reverse proxy level before reaching the helpdesk application.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N scoring 5.3 accurately captures the attack topology: the initial payload injection requires no authentication (PR:N) and no special conditions (AT:N), while downstream harm manifests in the subsequent system - the staff member's browser session - reflected in SC:L/SI:L rather than VC/VI. The UI:P requirement (staff must open the attachment) is a formally limiting factor but is operationally weak, since triaging attachments is routine helpdesk work. No EPSS data was supplied, no KEV listing is present, and no POC is publicly known, indicating this is a newly disclosed issue without confirmed active exploitation. Real-world priority is moderate: the attack surface is wide (any internet user can submit a ticket), the payload is persistent (stored), and the target population is privileged (staff with access to sensitive ticket data). The relatively low CVSS score reflects limited impact scope rather than low exploitability - defenders should not treat the 5.3 score as a deferral justification given the unauthenticated injection path and high-value target sessions.

An unauthenticated attacker submits a helpdesk ticket via the public web form, attaching a crafted .html file containing JavaScript that beacons the staff member's session cookie to an attacker-controlled server. When a helpdesk staff member opens the ticket to triage it and clicks the attachment link, the absence of a Content-Disposition: attachment header causes the browser to render the file inline in the authenticated session context, executing the script and silently exfiltrating the session token. No public exploit code has been identified at time of analysis, but the attack is mechanically straightforward given the documented injection surface.