Arbitrary File Deletion in FreeScout Help Desk by Authorized Users
CVE-2025-48480

7HIGH

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
30 May 2025

What is CVE-2025-48480?

FreeScout, a self-hosted help desk solution, has a vulnerability that allows authorized users with administrator privileges to manipulate user settings. Specifically, they can specify a path that leads to the avatar file during user creation, enabling them to delete the .htaccess file located in /storage/app/public. This can lead to significant security risks as it compromises the integrity of the system. The issue has been addressed in version 1.8.180, and it is crucial for users to update to this version to mitigate potential threats.

Affected Version(s)

freescout < 1.8.180

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48480 : Arbitrary File Deletion in FreeScout Help Desk by Authorized Users