CVE-2026-62855 · Package
NO FIX YET · SEE WHAT TO DO
FreeScout's administrator-only App Logs viewer checks the requested file path only as a raw string, so path traversal segments can escape the logs folder. An administrator who also holds the APP_KEY can use this to read any file the PHP worker can access, such as environment files and credentials.
first public Jul 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Exposure requires an administrator account that also knows the APP_KEY, so the risk is mostly insider or compromised-admin. Instances running FreeScout before 1.8.225 are affected, and self-hosted installs are the main concern. Teams that only use a managed FreeScout host are not responsible for patching it.
Not affected if managed-hosting, version-1.8.225-or-later
Who cares freescout, laravel, php, self-hosted
/app-logs/app and confirm which version is deployed.1.8.225FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply traversal segments that the filesystem normalizes outside storage/logs. The /app-logs/app route can then read local files accessible to the PHP worker, including environment files, source files, credentials, tokens, and operating-system files. This issue is fixed in version 1.8.225.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.