Deserialization Vulnerability in FreeScout Help Desk Software
CVE-2025-48389

8.6HIGH

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
29 May 2025

What is CVE-2025-48389?

FreeScout, a self-hosted help desk and shared mailbox solution, is susceptible to a deserialization vulnerability due to insufficient input validation prior to version 1.8.178. In this flaw, an attacker can exploit the set function to inject a serialized object string. Upon retrieving an option with the get method, the system executes deserialization, which may lead to arbitrary code execution. Admins are advised to upgrade to version 1.8.178 or later to mitigate this risk.

Affected Version(s)

freescout < 1.8.178

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/f...
x_refsource_MISC

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48389 : Deserialization Vulnerability in FreeScout Help Desk Software