Read the docs
TI-2025-34179 Aliases CVE-2025-54366

FreeScout's deserialization of untrusted data leads to Remote Code Execution

Priority HIGH 70CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework). In versions 1.8.185 and below, there is a critical deserialization vulnerability in the /conversation/ajax endpoint that allows authenticated users with knowledge of the APP_KEY to achieve remote code execution. The vulnerability occurs when the application processes the attachments_all and attachments POST parameters through the insecure Helper::decrypt() function, which performs unsafe deserialization of user-controlled data without proper validation. This flaw enables attackers to create arbitrary objects and manipulate their properties, leading to complete compromise of the web application. This is fixed in version 1.8.186.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01133 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed freescout (freescout-help-desk): 1.8.186

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
freescout-help-deskfreescoutbefore 1.8.1861.8.186Patch availableCNA
  • freescout Vendorfreescout-help-desk Affected before 1.8.186 Fixed in 1.8.186 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*before 1.8.86Vulnerablefreescout-help-desk
  • cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions before 1.8.86 Vulnerable ·freescout-help-desk

Remediation

  • Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.186

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54366

References

Exploit 1

Patch 1

  • TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
  • TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
  • TI-2026-25245 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) CVSS 3.1CRITICAL 9.3
  • TI-2026-22596 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2024-19354 FreeScout OS Command Injection vulnerability CVSS 3.1CRITICAL 9.1
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences