CVE-2025-68927

MediumCVSS 6.1

Published: 27/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

LibreDesk prior to version 0.8.6-beta is vulnerable to stored HTML injection in the contact notes feature. An attacker can inject arbitrary HTML elements such as forms and images, which are stored and rendered without proper sanitization.

Risk Assessment

This can lead to phishing, CSRF-style forced actions, and UI redress attacks, potentially exposing users to fraud or unauthorized actions.

Recommendation

Update LibreDesk to version 0.8.6-beta or later, which includes a fix for this vulnerability.

Other vulnerabilities in LibreDesk

CVE-2026-26957Low risk· EPSS 19%
CVE-2026-26957 has been rejected as the behavior described in the CVE record is intended. The Libredesk application is a single-tenant application, and configuring webhook URLs requires admin-only permissions that are not granted by default.

Original NVD description (English source)

Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS