CVE-2025-48390

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insufficient validation of user input in the php_path parameter. The backticks characters are not removed, as well as tabulation is not removed. When checking user input, the file_exists function is also called to check for the presence of such a file (folder) in the file system. A user with the administrator role can create a translation for the language, which will create a folder in the file system. Further in tools.php, the user can specify the path to this folder as php_path, which will lead to the execution of code in backticks. This issue has been patched in version 1.8.178.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-483917.5In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API CVE-2025-483927.5A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recom CVE-2025-483935.7The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attac CVE-2025-483944.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited CVE-2025-483954.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited CVE-2025-483968.3Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been CVE-2025-483977.1The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed i CVE-2025-48407.5The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a CVE-2025-48419.8A vulnerability was found in D-Link DCS-932L 2.18.01 and classified as critical. Affected by this issue is the function sub_404780 of the fi CVE-2025-484137.7The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shippe CVE-2025-484146.5There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to ad CVE-2025-484156.2A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contai