CVE-2026-53594CWE-22

FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

Medium · published July 20, 2026

CVSS v3.1
4.9
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-20T20:12Z
EPSS history
Timeline
  • 20 JUL 20:12Z
    FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path
    cvelistv5