CVE-2025-48390 – FreeScout Remote Code Injection Vulnerability

CVE ID : CVE-2025-48390

Published : May 29, 2025, 4:15 p.m. | 1 hour, 39 minutes ago

Description : FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insufficient validation of user input in the php_path parameter. The backticks characters are not removed, as well as tabulation is not removed. When checking user input, the file_exists function is also called to check for the presence of such a file (folder) in the file system. A user with the administrator role can create a translation for the language, which will create a folder in the file system. Further in tools.php, the user can specify the path to this folder as php_path, which will lead to the execution of code in backticks. This issue has been patched in version 1.8.178.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…