Django‑Helpdesk versions prior to 2.3.3 contain a stored cross‑site scripting flaw that permits attackers who do not need authentication to inject arbitrary JavaScript by submitting HTML‑formatted email messages or uploading .html/.htm files through public ticket submission channels. The vulnerability stems from the lack of sanitization and the omission of Content‑Disposition headers when attachments are served, enabling malicious scripts to run in the browser of any staff member who opens the affected attachment while triaging tickets. This can lead to credential theft, session hijacking, or other malicious actions performed under the staff user’s authority.

The affected product is django‑helpdesk, specifically all releases before 2.3.3. The patch version 2.3.3 introduces the necessary sanitization and proper content handling to remediate the XSS vector.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting limited data on exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via the public ticket submission interface without authentication, but the successful compromise requires a staff member to open the malicious attachment, making the attack vector internal (client‑side) but accessible to anyone who submits an HTML attachment. Given the lack of an active exploit and moderate CVSS, the risk is considered moderate overall, but patching is recommended to eliminate the possibility of browser‑based attacks that could lead to data exfiltration or compromise of staff accounts.