CVE-2025-48488: FreeScout Vulnerable to Stored XSS
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file containing malicious JavaScript code to the server, which can result in a Cross-Site Scripting (XSS) vulnerability. This issue has been patched in version 1.8.180.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48488?
CVE-2025-48488 is considered a critical XSS vulnerability that can be exploited if the file .htaccess is deleted.
How do I mitigate CVE-2025-48488?
To mitigate CVE-2025-48488, ensure that the .htaccess file remains intact and upgrade to FreeScout version 1.8.180 or later.
What type of attack does CVE-2025-48488 allow?
CVE-2025-48488 allows attackers to upload malicious HTML files that can execute JavaScript, leading to potential Cross-Site Scripting attacks.
Which versions of FreeScout are affected by CVE-2025-48488?
FreeScout versions prior to 1.8.180 are affected by CVE-2025-48488.
What are the implications of CVE-2025-48488 for users?
The implications of CVE-2025-48488 include the potential compromise of user data and the ability for attackers to execute malicious scripts in the users' browsers.