PT-2025-30950 · Freescout · Freescout

Artem Danilov + 2 · Published 2025-07-26 · Updated 2025-08-10 · CVE-2025-54366

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.186

Description FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework). Versions prior to 1.8.186 contain a critical deserialization vulnerability in the /conversation/ajax endpoint. Authenticated users with knowledge of the APP KEY can achieve remote code execution. The vulnerability occurs when the application processes the attachments all and attachments POST parameters through the Helper::decrypt() function, which performs unsafe deserialization of user-controlled data without proper validation. This allows attackers to create arbitrary objects and manipulate their properties, leading to complete compromise of the web application.

Recommendations Update to version 1.8.186 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-54366

GHSA-VCC2-6R66-GVVJ

Affected Products

Freescout

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54366.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-vcc2-6r66-gvvj · Vendor Advisory
• https://github.com/freescout-help-desk/freescout/commit/9669c57f1ddbee896752d9e16270abfd97b20eb9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-54366 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54366 · Vendor Advisory
• https://twitter.com/CVEnew/status/1948976642795139267 · Twitter Post
• https://twitter.com/0xm4v3rick/status/1953482238923858428 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1949005166285337013 · Twitter Post
• https://twitter.com/PentesterLab/status/1954674351804211568 · Twitter Post
• https://twitter.com/CveFindCom/status/1948959437114224655 · Twitter Post