Code Injection Vulnerability in FreeScout Help Desk Software

CVE-2025-48390

What is CVE-2025-48390?

FreeScout, a self-hosted help desk and shared mailbox solution, contains a code injection vulnerability arising from improper validation of user input within the php_path parameter. Malicious users, particularly those with administrative privileges, can manipulate the system by creating directories in the file system, allowing for arbitrary code execution through unchecked backtick characters. This flaw is particularly dangerous as it enables the execution of potentially harmful scripts. The vulnerability has been resolved in version 1.8.178, emphasizing the importance of maintaining updated software.

References