CVE-2026-53594
FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.
INFO
Published Date :
July 20, 2026, 9:16 p.m.
Last Modified :
Oct. 24, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update FreeScout to version 1.8.224.
- Apply vendor patches if available.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53594.
| URL | Resource |
|---|---|
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-858x-8f77-9vc5 | |
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-858x-8f77-9vc5 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53594 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53594
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53594 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53594 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: freescout de freescout-help-desk, Description: FreeScout es una mesa de ayuda gratuita y una bandeja de entrada compartida construida con el framework Laravel de PHP. La función Manage -> Logs -> App Logs de FreeScout utiliza la anulación rap2hpoutre/laravel-log-viewer incluida para descifrar un identificador de archivo proporcionado por el usuario y luego pasar la ruta resuelta a la respuesta de descarga de Laravel. Antes de la versión 1.8.224, la lógica de resolución de rutas acepta cualquier ruta absoluta existente antes de aplicar la restricción storage/logs prevista. Como resultado, un atacante que puede acceder a la ruta App Logs y falsificar un parámetro dl válido cifrado por Laravel puede descargar archivos arbitrarios locales del servidor legibles por el proceso PHP, no solo archivos de registro. La versión 1.8.224 contiene una corrección. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 21, 2026
Action Type Old Value New Value Added Reference https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-858x-8f77-9vc5 Added SSVC {'id': 'CVE-2026-53594', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-21T13:54:56.255536Z'} -
New CVE Received by [email protected]
Jul. 20, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'freescout-help-desk', 'product': 'freescout', 'versions': [{'status': 'affected', 'version': '< 1.8.224'}]}] Added Description FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix. Added CVSS V3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-22 Added Reference https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-858x-8f77-9vc5