Cross-Site Scripting Vulnerability in FreeScout Help Desk Software
CVE-2025-48488

4.6MEDIUM

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
30 May 2025

What is CVE-2025-48488?

FreeScout is a self-hosted help desk solution that, prior to version 1.8.180, exhibited a vulnerability allowing malicious users to delete the .htaccess file. This action facilitated the upload of an HTML file that could contain harmful JavaScript, leading to Cross-Site Scripting (XSS) incidents. The issue has since been resolved in the version 1.8.180 update. Administrators are encouraged to upgrade to this version to safeguard their applications from potential exploitation.

Affected Version(s)

freescout < 1.8.180

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48488 : Cross-Site Scripting Vulnerability in FreeScout Help Desk Software