CVE-2026-62855Medium· 4.4▾ TwilightPoC availableFreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrat…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 24.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply traversal segments that the filesystem normalizes outside storage/logs. The /app-logs/app route can then read local files accessible to the PHP worker, including environment files, source files, credentials, tokens, and operating-system files. This issue is fixed in version 1.8.225.
freescout < 1.8.225Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-62854High· 7.6FreeScout: Stored XSS in mailbox signature via same-origin JS upload
CVE-2026-62850Medium· 5.3FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets
CVE-2026-103984Medium· 6.5FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII
CVE-2026-103985High· 7.1FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
CVE-2026-107393Medium· 6.1FreeScout is a self-hosted help desk and shared mailbox
CVE-2026-62851Medium· 4.3FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox authorization)