CVE-2025-48389CWE-502

FreeScout Vulnerable to Deserialization of Untrusted Data

High · published May 29, 2025

CVSS v4.0
8.6
EPSS
1%
Percentile
59.6
In the wild
Unconfirmed
What it is

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the get method, deserialization will occur, which will allow arbitrary code execution This issue has been patched in version 1.8.178.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00911 · 59.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-05-29T15:12Z
EPSS history
Timeline
  • 29 MAY 15:12Z
    FreeScout Vulnerable to Deserialization of Untrusted Data
    cvelistv5