Path Traversal Vulnerability in FreeScout Help Desk by FreeScout
CVE-2026-62855

4.4MEDIUM

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
6 November 2026

What is CVE-2026-62855?

FreeScout's App Logs viewer, designed for administrators, is vulnerable to a path traversal issue where an administrator with access to the APP_KEY can manipulate folder and file parameters. This vulnerability allows the unauthorized reading of local files outside of the intended logs directory, compromising sensitive data such as environment configurations, source code, and credentials. The flaw has been addressed in version 1.8.225, emphasizing the importance of updating to the latest version to safeguard against potential exploits.

Affected Version(s)

freescout < 1.8.225

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/2...
x_refsource_MISC
https://github.com/freescout-help-desk/freescout/releases...
x_refsource_MISC

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.