FreeScout, a PHP‑based help‑desk solution, contains a Server‑Side Request Forgery flaw in Helper::sanitizeRemoteUrl. The function follows HTTP redirects but mistakenly validates only the original URL, ignoring the final redirection target. An attacker who can supply a URL that passes the initial host check can cause FreeScout to request internal HTTP endpoints such as cloud‑metadata services, internal APIs, or private IP ranges, thereby exposing sensitive internal resources.

The issue affects FreeScout, specifically all releases prior to version 1.8.217. Updating to 1.8.217 or later removes the flaw, as the redirect target is now properly validated.

The CVSS score of 7.7 indicates a high‑risk condition, and the vulnerability is classified as CWE‑918. Exploitation can occur from any interface that accepts external URLs processed by sanitizeRemoteUrl; an attacker need only craft a URL that passes host validation and leads to a redirect inside the application. Because the exploit allows internal service discovery and potential data leakage, the threat level is significant despite the absence of a current EPSS score or KEV listing. The safest mitigation is to apply the vendor‑supplied patch, but temporary containment can be achieved through isolation of outbound traffic.