Report a security vulnerability in the application core: https://github.com/freescout-help-desk/freescout/security/advisories (ONE issue per advisory)
Report a security vulnerability in a module: https://freescout.net/contact-us/
Security: freescout-help-desk/freescout
Security
SECURITY.md
-
Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})GHSA-56h2-5556-r6mg published
Mar 17, 2026 by freescout-help-deskCritical -
Stored XSS through SVG file upload with filter bypassGHSA-cvr8-cw5c-5pfw published
Mar 17, 2026 by freescout-help-deskHigh -
Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer MessagesGHSA-wxg5-g9vv-v8g9 published
Mar 17, 2026 by freescout-help-deskLow -
FreeScout 1.8.206 - Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Unauthenticated Remote Code ExecutionGHSA-5gpc-65p8-ffwp published
Feb 28, 2026 by freescout-help-deskCritical -
Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on ApacheGHSA-mw88-x7j3-74vc published
Feb 24, 2026 by freescout-help-deskHigh -
Predictable Authentication Token Enables Account TakeoverGHSA-6gcm-v8xf-j9v9 published
Feb 24, 2026 by freescout-help-deskCritical -
Deserialization of untrusted data leads to Remote code execution (RCE) [10]GHSA-cj33-85w7-329x published
Sep 2, 2025 by freescout-help-deskHigh -
Deserialization of untrusted data leads to Remote code execution (RCE) [9]GHSA-vcc2-6r66-gvvj published
Jul 24, 2025 by freescout-help-deskHigh -
Deserialization of untrusted data leads to Remote code execution [8]GHSA-436c-xwcp-mfvp published
Sep 2, 2025 by freescout-help-deskHigh -
Deserialization of untrusted data leads to Remote code execution [7]GHSA-cgpf-pwqj-gg2r published
Sep 2, 2025 by freescout-help-deskHigh
Learn more about advisories related to freescout-help-desk/freescout in the GitHub Advisory Database