CVE-2026-23753: GFI HelpDesk < 4.99.9 Stored XSS via charset Parameter
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFTLanguage::Create() without HTML sanitization and subsequently rendered unsanitized by ViewLanguage.RenderGrid(). An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, and the payload executes in the browser of any administrator viewing the Languages page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23753?
CVE-2026-23753 is classified as a medium severity vulnerability.
How do I fix CVE-2026-23753?
To fix CVE-2026-23753, upgrade GFI HelpDesk to version 4.99.9 or higher.
What type of vulnerability is CVE-2026-23753?
CVE-2026-23753 is a stored cross-site scripting (XSS) vulnerability.
What components are affected by CVE-2026-23753?
CVE-2026-23753 affects the language management functionality of GFI HelpDesk versions prior to 4.99.9.
What does the charset parameter exploit in CVE-2026-23753?
The charset parameter in CVE-2026-23753 is exploited because it is passed directly without HTML sanitization.