{"affected":[{"product":"freescout","source":"CNA: GitHub_M","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.230"}]},{"ecosystem":"composer","packageName":"freescout-help-desk/freescout","product":"freescout-help-desk/freescout","source":"GitHub GHSA-6w8v-qp43-vg2h","vendor":"","versions":[{"status":"affected","version":"<1.8.230","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-85743","cwes":["CWE-918"],"description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently enforce a sink-level restricted-host policy. An authenticated administrator, or another authenticated user permitted to change mailbox connection settings or trigger module update or installation paths, can supply attacker-controlled URLs or hosts. The independent download and port-test sinks can reach encoded or otherwise uncovered loopback and internal addresses. The redirect-validation bypass additionally requires a configured whitelist that permits the original and final hosts while a restricted internal host appears only as an intermediate redirect hop. No unauthenticated SSRF path is established. The server can consequently contact loopback and internal services, provide a blind internal port oracle, and retrieve internal HTTP responses into application-controlled download sinks. This issue is fixed in version 1.8.230.","epss":{"date":"2026-11-10","percentile":0.18326,"score":0.00264},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h"}],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},{"score":8.2,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L","version":"3.1"}],"modifiedAt":1794366782881,"publishedAt":1793984786940,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/commit/09799fd4bcf731704bc2099a87bca0cf18d20acb"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/commit/a4c587cf1fff87eae7d3e4f297fa4cc81ba28704"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/commit/09799fd4bcf731704bc2099a87bca0cf18d20acb"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/commit/a4c587cf1fff87eae7d3e4f297fa4cc81ba28704"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-6w8v-qp43-vg2h","text":"freescout-help-desk/freescout (composer): GitHub reports patched versions 1.8.230. Check the advisory for the affected release branch.","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h"}],"revision":"12c80bd3c3c2bf32428167a5ebfbfa6b48bdcc91ea1dae840570adc4d07f4707","sources":[{"modifiedAt":1794366782881,"name":"CNA: GitHub_M","retrievedAt":1794370185613,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85743"},{"modifiedAt":1793985602567,"name":"NVD","retrievedAt":1793990257239,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85743"},{"modifiedAt":1788549601000,"name":"GitHub Security Advisories","retrievedAt":1794138909465,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794370186085,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85743"}],"ssvc":{"assessedAt":1794366754893,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks","updatedAt":1794370186085}