libredesk vulnerabilities
CVEs whose affected-version data names the libredesk package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111168Medium· 5.4LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xm…
▾ Sunlitabhinavxd · libredeskEPSS 0.23%via NVD
CVE-2025-68927Medium· 6.1Libredesk is a self-hosted customer support desk
Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatical…
▾ Sunlitlibredesk · libredeskEPSS 0.23%via NVD