CVE-2026-32754 is a critical stored cross site scripting flaw in FreeScout, the open source help desk, scored CVSS 9.3. Incoming email bodies were stored unsanitized and printed raw into notification emails. Anyone could send such an email. Upgrade to FreeScout 1.8.209 or later.
What's affected
FreeScout 1.8.208 and below are affected, according to the NVD record. The GitHub advisory says versions before 1.8.209 are affected and lists 1.8.209 as patched. The package on Composer is freescout-help-desk/freescout.
The advisory points at two email templates, notification.blade.php for agents and reply_fancy.blade.php for customers. It says the browser thread view was already safe, since it cleaned the body.
The fix shipped in 1.8.209 together with several other security fixes, listed in the release notes.
How to check if you're exposed
Find the version your deployment runs. If you installed from a release archive or git tag, compare it with 1.8.209:
git describe --tags
If you track the dist branch, make sure it includes the 1.8.209 release.
Also consider the audience. The attack starts with an email to any mailbox you monitor, so every help desk that receives mail from the public is in scope.
What to do now
- Upgrade FreeScout to 1.8.209 or later.
- Read the release notes. They list other security fixes, such as mailbox access checks and SVG sanitizing.
- Tell agents to be careful opening notification emails in clients that run active content until you have patched.
- Consider turning on a CSP header for attachments, which the release notes say was added.
- Review recent inbound mail for messages with unusual HTML if you want to look back.
The 1.8.209 release includes more than this fix. According to its notes, it also checks customer visibility on the Customer Conversations page, checks mailbox access when a user edits a customer thread, improves sanitizing of SVG images that contain comments, and adds a CSP header when showing attachments.
It also hides the IMAP password in fetch command debug output, encrypts OAuth tokens for IMAP and SMTP, encrypts module license keys, and offers TLS by default in the fetching and sending settings. Read the list before you upgrade so your team knows what changes.
Why it matters
The weaknesses are CWE-79, cross site scripting, and CWE-116, improper encoding or escaping of output. The advisory points to the Blade raw output syntax, which prints a value without escaping it, applied to a stored email body that was never cleaned on the way in.
The result is that outside content reaches the inbox of every subscribed agent. NVD says this allows HTML injection for phishing and tracking in any client, and script execution in vulnerable email clients. The record's KEV flag is false, and the advisory does not report exploitation.
Quick check
Do I need an account to attack it?
No. The record says an unauthenticated attacker only has to send an email that an agent or admin later opens.
Sources
Last reviewed: 19 October 2026.
