FreeScout versions 1.8.208 and earlier contain a stored cross‑site scripting flaw that allows an authenticated user to upload a file named with a harmless image extension, such as .png, but with a MIME type of image/svg+xml. The upload logic checks only the extension and the MIME type, so the server treats the file as a safe inline image; however, the SVG body can contain embedded JavaScript. When another user or administrator opens the link to the uploaded file, the malicious script runs in their browser, enabling the attacker to perform arbitrary actions on their behalf.

The vulnerability applies to the free help‑desk software Freescout from the vendor freescout‑help‑desk. All releases up to and including version 1.8.208 are affected; versions 1.8.209 and newer include the fix.

The CVSS base score is 8.5, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. To exploit the flaw an attacker must first be an authenticated user who uploads the crafted file; any subsequent user – for example an administrator – who opens the link to the uploaded file will have the malicious script executed in their browser. The execution grants the attacker full control over that user’s session, enabling data theft, session hijacking, and unauthorized actions within the application.