{"id":"CVE-2026-62855","title":"FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files","summary":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrat…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-23"],"vendor":"freescout-help-desk","product":"freescout","affected":["freescout < 1.8.225"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T17:45:55.570543Z"},"exploitAvailable":true,"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:46:15.847Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62855","references":[{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ph7-f3hc-95gg","label":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ph7-f3hc-95gg"},{"url":"https://github.com/freescout-help-desk/freescout/commit/2cd2e66b772ea9f9513cac6e82f9381bac9993c3","label":"https://github.com/freescout-help-desk/freescout/commit/2cd2e66b772ea9f9513cac6e82f9381bac9993c3"},{"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225","label":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-11-06T18:00:12.506Z","slug":"CVE-2026-62855","body":"## Overview\n\nFreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply traversal segments that the filesystem normalizes outside storage/logs. The /app-logs/app route can then read local files accessible to the PHP worker, including environment files, source files, credentials, tokens, and operating-system files. This issue is fixed in version 1.8.225.\n\n## Affected\n\n- `freescout < 1.8.225`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}