CVE-2026-40565

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML attributes. Version 1.8.213 fixes the issue.

• CWE-79

• https://github.com/freescout-help-desk/freescout/commit/265379b3ae343f06846adc0aa8510643d1eac2dfPatch
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213Release Notes
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-49pm-xwqj-vwjpVendor Advisory
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-49pm-xwqj-vwjpVendor Advisory

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4056The User Registration & Membership plugin for WordPress is v…5.4
• CVE-2026-40560Starman versions before 0.4018 for Perl allows HTTP Request …7.5
• CVE-2026-40561Starlet versions through 0.31 for Perl allows HTTP Request S…5.3
• CVE-2026-40562Gazelle versions through 0.49 for Perl allows HTTP Request S…7.5
• CVE-2026-40563Description: Improper Control of Generation of Code ('Code I…8.1
• CVE-2026-40564Files or Directories Accessible to External Parties, Server-…6.5
• CVE-2026-40566FreeScout is a free self-hosted help desk and shared mailbox…4.1
• CVE-2026-40567FreeScout is a free self-hosted help desk and shared mailbox…5.8
• CVE-2026-40568FreeScout is a free self-hosted help desk and shared mailbox…8.5
• CVE-2026-40569FreeScout is a free self-hosted help desk and shared mailbox…9
• CVE-2026-4057The Download Manager plugin for WordPress is vulnerable to u…4.3
• CVE-2026-40570FreeScout is a free self-hosted help desk and shared mailbox…5.7