CVE-2026-34442: FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeScoutto a version that resolves this vulnerability.Fixed in 1.8.211
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34442?
CVE-2026-34442 has a medium severity rating due to its potential for exploitation through host header manipulation.
How do I fix CVE-2026-34442?
To fix CVE-2026-34442, upgrade your FreeScout installation to version 1.8.211 or later.
What types of attacks can CVE-2026-34442 enable?
CVE-2026-34442 can enable external resource loading and open redirect attacks due to host header injection.
Which versions of FreeScout are affected by CVE-2026-34442?
CVE-2026-34442 affects FreeScout versions prior to 1.8.211.
Is CVE-2026-34442 related to PHP or Laravel vulnerabilities?
CVE-2026-34442 specifically involves a host header injection vulnerability in FreeScout built on the Laravel framework.