This vulnerability allows a user who can edit a mailbox signature to upload a scriptable file that bypasses the application’s tag‑filtering routine. The file, combined with nested tag fragments, results in an external script served from the same origin. When another user opens a reply editor or a new‑ticket page, the policy permits the script to run, giving it the victim’s FreeScout privileges to read visible data and perform same‑origin actions.

Affected systems are installations of the Freescout help‑desk application prior to version 1.8.225 – all repositories under the freescout-help-desk:freescout vendor. The patch is released in 1.8.225.

The vulnerability scored a CVSS of 7.6. EPSS is not available and the vulnerability is not listed in CISA KEV. The likely attack can be carried out by a user with permission to edit mailbox signatures, who also has access to upload files. Successful exploitation would allow the attacker’s script to run under the victim’s credentials, potentially exfiltrating data or manipulating free‑scoped operations within the application.