Deserialization Vulnerability in FreeScout Help Desk by FreeScout
CVE-2025-54366

8.6HIGH

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
26 July 2025

What is CVE-2025-54366?

FreeScout, an open-source help desk application built on the Laravel framework, is susceptible to a deserialization vulnerability in versions up to and including 1.8.185. This flaw exists in the /conversation/ajax endpoint and allows authenticated users with knowledge of the APP_KEY to exploit the application's insecure data processing. When the Helper::decrypt() function handles the attachments_all and attachments POST parameters, it fails to validate user-controlled data adequately. This improper handling enables attackers to instantiate arbitrary objects and modify their properties, thereby compromising the integrity of the entire web application. The issue has been addressed in version 1.8.186.

Affected Version(s)

freescout < 1.8.186

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/9...
x_refsource_MISC

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54366 : Deserialization Vulnerability in FreeScout Help Desk by FreeScout