CVE-2026-23756: GFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Subject
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in ControllerStep.InsertSubmit() and EditSubmit() before being rendered by ViewStep.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject field, and the payload executes when any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23756?
CVE-2026-23756 is classified as a medium severity vulnerability.
How do I fix CVE-2026-23756?
To fix CVE-2026-23756, upgrade GFI HelpDesk to version 4.99.9 or above.
What type of vulnerability is CVE-2026-23756?
CVE-2026-23756 is a stored cross-site scripting (XSS) vulnerability.
Which versions of GFI HelpDesk are affected by CVE-2026-23756?
GFI HelpDesk versions prior to 4.99.9 are affected by CVE-2026-23756.
What components are involved in CVE-2026-23756?
CVE-2026-23756 involves the Troubleshooter module, specifically the subject POST parameter.