CVE-2026-73531

Name of the Vulnerable Software and Affected Versions django-helpdesk versions prior to 2.3.3

Description A stored cross-site scripting issue allows unauthenticated attackers to inject arbitrary JavaScript. This is achieved by submitting HTML-formatted email messages or uploading .html or .htm file attachments via public ticket submission channels. The flaw stems from a lack of sanitization and missing Content-Disposition headers at the attachment-serving layer, enabling malicious scripts to execute in the browser session of authenticated staff members when they open the attachment during ticket triage.

Recommendations Update django-helpdesk to version 2.3.3 or later.