CVE-2025-54366 Details
Description
FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework). In versions 1.8.185 and below, there is a critical deserialization vulnerability in the /conversation/ajax endpoint that allows authenticated users with knowledge of the APP_KEY to achieve remote code execution. The vulnerability occurs when the application processes the attachments_all and attachments POST parameters through the insecure Helper::decrypt() function, which performs unsafe deserialization of user-controlled data without proper validation. This flaw enables attackers to create arbitrary objects and manipulate their properties, leading to complete compromise of the web application. This is fixed in version 1.8.186.
A critical deserialization vulnerability allowing remote code execution has been identified in FreeScout versions through 1.8.185. This vulnerability exists in the '/conversation/ajax' endpoint, where authenticated users with knowledge of the APP_KEY can exploit the issue. The problem arises because the application improperly processes the 'attachments_all' and 'attachments' POST parameters using the 'Helper::decrypt()' function, which unsafely deserializes user-controlled data without adequate validation. This flaw enables attackers to create arbitrary objects, manipulate their properties, and achieve complete compromise of the web application.
Users can upgrade to FreeScout version 1.8.186 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freescout freescout | < 1.8.86 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2025 | Initial Analysis | [email protected] |
| Jul 26, 2025 | New CVE Received | [email protected] |