CVE-2025-68927
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
LibreDesk prior to version 0.8.6-beta is vulnerable to stored HTML injection in the contact notes feature. An attacker can inject arbitrary HTML elements such as forms and images, which are stored and rendered without proper sanitization.
Risk Assessment
This can lead to phishing, CSRF-style forced actions, and UI redress attacks, potentially exposing users to fraud or unauthorized actions.
Recommendation
Update LibreDesk to version 0.8.6-beta or later, which includes a fix for this vulnerability.
Other vulnerabilities in LibreDesk
See all- CVE-2026-111168Medium
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
- CVE-2026-26957Low risk· EPSS 19%
CVE-2026-26957 has been rejected as the behavior described in the CVE record is intended. The Libredesk application is a single-tenant application, and configuring webhook URLs requires admin-only permissions that are not granted by default.
Original NVD description (English source)
Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS