Remote Code Execution Vulnerability in FreeScout by FreeScout
CVE-2025-48471

7HIGH

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
29 May 2025

What is CVE-2025-48471?

FreeScout, a self-hosted help desk solution, contains a vulnerability that permits insufficient verification of files uploaded to the application. This weakness allows malicious files with the phtml and phar extensions to be uploaded, potentially leading to remote code execution, particularly when hosted on an Apache web server. Users are advised to update to version 1.8.179 or later to mitigate this risk.

Affected Version(s)

freescout < 1.8.179

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/e...
x_refsource_MISC

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48471 : Remote Code Execution Vulnerability in FreeScout by FreeScout