CVE-2026-53596: FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeScoutto a version that resolves this vulnerability.Fixed in 1.8.224
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53596?
The severity of CVE-2026-53596 is classified as medium with a score of 5.3.
How do I fix CVE-2026-53596?
To fix CVE-2026-53596, upgrade to FreeScout version 1.8.224 or later where the issue has been addressed.
What type of attack does CVE-2026-53596 facilitate?
CVE-2026-53596 facilitates a denial of service (DoS) attack by allowing unrestricted file uploads that can flood the server.
What systems are affected by CVE-2026-53596?
CVE-2026-53596 affects FreeScout versions prior to 1.8.224.
What impact does CVE-2026-53596 have on the server?
CVE-2026-53596 can lead to resource exhaustion, causing potential database overload and service interruption.