CVE-2026-53594
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
FreeScout prior to version 1.8.224 has a vulnerability in the App Logs feature that allows an authenticated attacker to download arbitrary server-local files readable by the PHP process via manipulation of the dl parameter.
Risk Assessment
An attacker can read sensitive server files such as configurations or credentials, leading to information disclosure.
Recommendation
Upgrade FreeScout to version 1.8.224 or later, which fixes this vulnerability.
Other vulnerabilities in FreeScout
See all- CVE-2026-41906High
FreeScout is a free help desk and shared inbox built with the Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers, but the backend conversation_change_customer action accepts any supplied customer_email.
- CVE-2026-41905High
FreeScout prior to version 1.8.217 had a vulnerability in the Helper::sanitizeRemoteUrl() function that improperly validated URLs after HTTP redirects. An attacker could exploit this vulnerability to redirect traffic to internal HTTP services that would normally be blocked.
- CVE-2026-41904High
FreeScout prior to version 1.8.217 allows users with updateAutoReply permission to store an XSS payload in the auto-reply message. The payload is rendered unescaped in the auto-reply email sent to customers.
- CVE-2026-53595Critical
In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.
- CVE-2026-41902Critical
FreeScout prior to version 1.8.217 has a vulnerability in the /user-setup/{hash} endpoint that accepts a 60-character random invite_hash to set a new user's password. The lack of expiration check allows for unauthorized account takeover long after the invite was issued.
- CVE-2026-53596Medium
FreeScout, a free help desk built with Laravel, does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
- CVE-2026-53593High
FreeScout before version 1.8.224 has an incomplete denylist of dangerous file extensions, missing the .pht extension. An authenticated agent can upload a .pht web shell, leading to remote code execution on the web server.
- CVE-2026-53592Medium
A Prototype Pollution vulnerability in the getQueryParam function in /public/js/main.js in FreeScout. The fix in version 1.8.139 is incomplete, allowing attacks via nested URL keys. Fixed in version 1.8.223.
- CVE-2026-53591High
Vulnerability in FreeScout before version 1.8.223. An unauthenticated attacker can inject a message into any existing support conversation by sending an email with a crafted In-Reply-To header. The message appears as a customer reply, and the conversation is automatically reopened.
- CVE-2026-48812High
Vulnerability in FreeScout (versions prior to 1.8.221) in the attachment download mechanism. An unauthenticated attacker can download any attachment created by an older version because token authentication is skipped for attachments with legacy token type.
Original NVD description (English source)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.