CVE-2025-48389: FreeScout Vulnerable to Deserialization of Untrusted Data

Q: What is the severity of CVE-2025-48389?

CVE-2025-48389 has a high severity rating due to its potential for exploitation through deserialization of untrusted data.

Q: How do I fix CVE-2025-48389?

To fix CVE-2025-48389, upgrade to FreeScout version 1.8.178 or later where the vulnerability is resolved.

Q: What systems are affected by CVE-2025-48389?

CVE-2025-48389 affects FreeScout versions prior to 1.8.178.

Q: What type of vulnerability is CVE-2025-48389?

CVE-2025-48389 is a deserialization of untrusted data vulnerability.

Q: Is CVE-2025-48389 easily exploitable?

Yes, CVE-2025-48389 can be easily exploited if the system remains unpatched.

Published May 29, 2025

Updated

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the get method, deserialization will occur, which will allow arbitrary code execution This issue has been patched in version 1.8.178.

Affected Software

2 affected components

Freescout freescout<1.8.178

Remediation

Patch Available

https://github.com/freescout-help-desk/freescout/commit/f7548a7076a0b6e109001069d6be223fbd96c61e

Event History

May 29, 2025

CVE Published

via MITRE·03:12 PM

Data Sourced

via MITRE·03:12 PM

DescriptionWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-48389?

CVE-2025-48389 has a high severity rating due to its potential for exploitation through deserialization of untrusted data.

How do I fix CVE-2025-48389?