CVE-2025-68927
Description
Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.
How to fix
- libredesk libredesk0.8.6 or later
- github.com/abhinavxd/libredesk0.8.6-beta or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libredesk libredesk | v < 0.8.6 | 0.8.6 |
| github.com/abhinavxd/libredeskGo | v < 0.8.6-beta, No range specified | 0.8.6-beta |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.