PT-2025-23263 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-05-30 · CVE-2025-48488

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description The issue allows an attacker to upload an HTML file containing malicious JavaScript code to the server, resulting in a Cross-Site Scripting (XSS) vulnerability. This occurs when the .htaccess file is deleted prior to version 1.8.180.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to the server to prevent malicious file uploads until the update is applied. Additionally, avoid deleting the .htaccess file to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06964

CVE-2025-48488

GHSA-2M76-538H-7HF9

Affected Products

Freescout

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48488.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2m76-538h-7hf9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48488 · Security Note
• https://bdu.fstec.ru/vul/2025-06964 · Security Note
• https://twitter.com/VulmonFeeds/status/1928374934759239972 · Twitter Post
• https://t.me/cvetracker/24982 · Telegram Post
• https://twitter.com/CVEnew/status/1928343312194322747 · Twitter Post