CVE-2026-34442 FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout
Attackers can manipulate the Host header to redirect users to malicious domains or load external resources, potentially leading to phishing or data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-34442?
CVE-2026-34442 is a medium-severity vulnerability in freescout-help-desk freescout, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.
Which versions are affected by CVE-2026-34442?
It affects 1 product.
Products include Freescout Freescout.
How do I fix CVE-2026-34442?
No fix has been published for CVE-2026-34442 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-34442 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34442 exists.
Other vulnerabilities in freescout-help-desk freescout
- CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2024-29185 FreeScout OS Command Injection vulnerability
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
Sources
Also known as GHSA-822g-7rw5-53xj.