CVE-2026-23758: GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in ControllerTicket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23758?
CVE-2026-23758 is classified as a stored cross-site scripting vulnerability that poses a medium severity risk due to its potential for exploitation by authenticated users.
How do I fix CVE-2026-23758?
To fix CVE-2026-23758, upgrade to GFI HelpDesk version 4.99.9 or later to mitigate the stored XSS vulnerability.
Who is affected by CVE-2026-23758?
CVE-2026-23758 affects GFI HelpDesk versions prior to 4.99.9, specifically targeting authenticated staff members.
What can attackers do with CVE-2026-23758?
Attackers exploiting CVE-2026-23758 can inject malicious JavaScript into the ticket subject field, potentially compromising user sessions.
When was CVE-2026-23758 disclosed?
CVE-2026-23758 was disclosed in 2026, prompting users to update their GFI HelpDesk software to protect against the vulnerability.