LibreDesk vulnerabilities

LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.

CVE-2026-26957 has been rejected as the behavior described in the CVE record is intended. The Libredesk application is a single-tenant application, and configuring webhook URLs requires admin-only permissions that are not granted by default.

LibreDesk prior to version 0.8.6-beta is vulnerable to stored HTML injection in the contact notes feature. An attacker can inject arbitrary HTML elements such as forms and images, which are stored and rendered without proper sanitization.