CVE-2025-48390: FreeScout Vulnerable to Remote Code Execution (RCE)
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insufficient validation of user input in the phppath parameter. The backticks characters are not removed, as well as tabulation is not removed. When checking user input, the fileexists function is also called to check for the presence of such a file (folder) in the file system. A user with the administrator role can create a translation for the language, which will create a folder in the file system. Further in tools.php, the user can specify the path to this folder as phppath, which will lead to the execution of code in backticks. This issue has been patched in version 1.8.178.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48390?
CVE-2025-48390 is classified as a critical vulnerability due to its potential for code injection.
How do I fix CVE-2025-48390?
To fix CVE-2025-48390, upgrade FreeScout to version 1.8.178 or later to ensure proper validation of user input.
What types of attacks can exploit CVE-2025-48390?
CVE-2025-48390 can be exploited for code injection attacks, allowing attackers to execute arbitrary code on the server.
What versions of FreeScout are affected by CVE-2025-48390?
FreeScout versions prior to 1.8.178 are vulnerable to CVE-2025-48390.
Is there a workaround for CVE-2025-48390?
Currently, the best mitigation for CVE-2025-48390 is to upgrade to the latest version of FreeScout.