CVE-2026-62855 in FreeScout
Summary
by MITRE • 11/06/2026
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply traversal segments that the filesystem normalizes outside storage/logs. The /app-logs/app route can then read local files accessible to the PHP worker, including environment files, source files, credentials, tokens, and operating-system files. This issue is fixed in version 1.8.225.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
FreeScout is a self-hosted help desk application built on the Laravel framework that manages shared mailboxes and support tickets. In versions prior to 1.8.225, the application contains a critical path traversal vulnerability within its administrative logging interface. The App Logs viewer feature allows administrators to view system logs by accepting parameters for folder names and file paths. These parameters are encrypted using Laravel's standard encryption mechanism before being passed to the backend logic. However, the security implementation fails to properly validate or sanitize these decrypted values against a strict allowlist of expected directories. Instead, the application treats the decrypted path as a raw string and passes it directly to filesystem operations without verifying that the resulting normalized path remains within the intended storage/logs directory boundary.
This architectural flaw enables an attacker with administrative privileges who also possesses knowledge of the Laravel APP_KEY to manipulate the encrypted parameters. By injecting relative path traversal sequences such as dot-dot-slash into the folder or file parameter, the attacker can cause the filesystem normalization process to resolve paths outside the restricted log directory. Once the application resolves this maliciously constructed path, it proceeds to read and return the contents of arbitrary local files accessible to the PHP worker process. This capability effectively bypasses the intended isolation between the web application's public-facing features and sensitive server-side resources.
The operational impact of this vulnerability is severe due to the potential for comprehensive data exfiltration. An authenticated administrator can leverage this flaw to read critical configuration files, including environment variables that may contain database credentials, API keys, and other secrets. Furthermore, access extends to application source code which could reveal additional logic flaws or hardcoded tokens. The scope of exposure also includes operating system-level files if the PHP worker has sufficient permissions, potentially leading to further compromise of the underlying infrastructure. This aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-359 Exposure of Private Personal Information to an Unauthorized Actor under ATT&CK technique T1005 Data from Local System.
The vulnerability is resolved in FreeScout version 1.8.225 through improved input validation that ensures decrypted path parameters are strictly confined within the allowed log directory structure before any filesystem interaction occurs. To mitigate risks for users still operating on older versions, it is imperative to restrict administrative access to trusted individuals only and ensure that the APP_KEY remains confidential and rotated regularly if compromised. Additionally, deploying a Web Application Firewall with rules capable of detecting path traversal patterns in encrypted payloads may provide an additional layer of defense until an upgrade can be performed. Immediate patching to version 1.8.225 or later is strongly recommended to eliminate this attack vector and protect sensitive organizational data from unauthorized disclosure.