PT-2025-35650 · Laravel+2 · Laravel+2

Artem Danilov + 2 · Published 2025-09-03 · Updated 2025-09-08 · CVE-2025-58163

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeScout versions 1.8.185 and earlier

Description FreeScout is a help desk and shared inbox built with PHP’s Laravel framework. Versions prior to 1.8.186 contain a deserialization of untrusted data issue that allows authenticated attackers with knowledge of the application's APP KEY to achieve remote code execution. The vulnerability is exploited via the /help/{mailbox id}/auth/{customer id}/{hash}/{timestamp} endpoint, where the customer id and timestamp parameters are processed through the decrypt function in app/Helper.php without proper validation. The code decrypts using Laravel's built-in encryption functions, which subsequently deserialize the decrypted payload without sanitization, allowing attackers to craft malicious serialized PHP objects to trigger arbitrary command execution.

Recommendations Upgrade to FreeScout version 1.8.186 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-58163

GHSA-J94W-Q9GJ-C37G

Affected Products

Freescout

Laravel

Php

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58163.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-j94w-q9gj-c37g · Vendor Advisory
• https://github.com/freescout-help-desk/freescout/commit/e2de65f3f32f825b4ec5558643ed81438c9a6bc6 · Patch
• https://osv.dev/vulnerability/CVE-2025-58163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58163 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.186 · Note
• https://github.com/freescout-help-desk/freescout/commit/1794763bbb17509af3183e667d695056545ef62a · Note
• https://twitter.com/VulmonFeeds/status/1963144241011376429 · Twitter Post
• https://t.me/CVEtracker/31545 · Telegram Post
• https://t.me/cveNotify/134633 · Telegram Post