CVE-2026-34442

Name: CVE-2026-34442
Creator: NVD / NIST
Published: 2026-03-31T22:16:19.333+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.1/10EPSS 0.22%

Last modified Jun 17, 2026

CVE-2026-34442 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.

Metrics

CVSS 3.1

6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

0.22%

12.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Freescout	Freescout	< 1.8.211

References

https://github.com/freescout-help-desk/freescout/commit/889d75c8e3c15e6a7ddb6a4d4f65cc0379c29213Patch
https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211Release Notes
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xjExploit, Vendor Advisory
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xjExploit, Vendor Advisory

Timeline

Published: Mar 31, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-34442?

How severe is CVE-2026-34442?

CVE-2026-34442 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.

How do I fix CVE-2026-34442?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-34442?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST