CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments
Unauthenticated attackers can inject JavaScript via HTML attachments in django-helpdesk, leading to script execution in staff browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-73531?
CVE-2026-73531 is a medium-severity cross-site scripting vulnerability in django-helpdesk, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can exploit the lack of sanitization and Content-Disposition headers at the attachment-serving layer to execute malicious scripts in the browser session of authenticated staff members who open the attachment while triaging tickets.
Weakness: CWE-79
Which versions are affected by CVE-2026-73531?
How do I fix CVE-2026-73531?
No fix has been published for CVE-2026-73531 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73531 being exploited?
There is no known exploitation of CVE-2026-73531 in the wild and no public exploit code.
Sources
Also known as GHSA-67qv-r9gc-cpwj, GHSA-q46c-8w98-fq2g.