{"id":"CVE-2026-62855","kind":"vulnerability","aliases":["CVE-2026-62855"],"related":[],"title":"FreeScout: admin log viewer lets traversal read server files","description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply traversal segments that the filesystem normalizes outside storage/logs. The /app-logs/app route can then read local files accessible to the PHP worker, including environment files, source files, credentials, tokens, and operating-system files. This issue is fixed in version 1.8.225.","summary":"FreeScout's administrator-only App Logs viewer checks the requested file path only as a raw string, so path traversal segments can escape the logs folder. An administrator who also holds the APP_KEY can use this to read any file the PHP worker can access, such as environment files and credentials.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freescout","laravel","package","php","self-hosted"],"not_affected_if":["managed-hosting","version-1.8.225-or-later"],"how_to_check":"- Check the installed FreeScout version against the fixed version listed below.\n- Look at the FreeScout install directory for the App Logs route `/app-logs/app` and confirm which version is deployed.","fix":"- FreeScout: `1.8.225`","status":"open","published_at":"2026-11-06T17:18:33+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","triaged_at":"2026-11-06T17:45:36+00:00","updated_at":"2026-11-06T17:45:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T17:45:36Z","model":"claude-haiku-5-5","output":{"fix":"- FreeScout: `1.8.225`","reach":"internet","title":"FreeScout: admin log viewer lets traversal read server files","impact":"medium","summary":"FreeScout's administrator-only App Logs viewer checks the requested file path only as a raw string, so path traversal segments can escape the logs folder. An administrator who also holds the APP_KEY can use this to read any file the PHP worker can access, such as environment files and credentials.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freescout","self-hosted","php","laravel"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Admin reads server files including environment secrets and credentials","analyst_note":"","how_to_check":"- Check the installed FreeScout version against the fixed version listed below.\n- Look at the FreeScout install directory for the App Logs route `/app-logs/app` and confirm which version is deployed.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","version-1.8.225-or-later"],"who_is_affected":"Exposure requires an administrator account that also knows the APP_KEY, so the risk is mostly insider or compromised-admin. Instances running FreeScout before 1.8.225 are affected, and self-hosted installs are the main concern. Teams that only use a managed FreeScout host are not responsible for patching it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4339,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62855':12A,15A '/app-logs/app':134C '1.8.225':89C,164C 'accept':97C 'access':69B,141C 'admin':2A 'administr':26B,51B,92C,116C 'administrator-on':25B,91C 'also':53B,118C 'app':28B,56B,94C,121C 'check':31B,109C 'construct':106C 'credenti':75B,151C 'cve':10A,13A 'desk':83C 'encrypt':100C 'environ':72B,147C 'escap':46B 'file':9A,34B,64B,73B,103C,140C,148C,150C,157C 'filesystem':129C 'fix':161C 'folder':49B,101C 'freescout':1A,16B,23B,76C 'help':82C 'hold':54B 'host':22B,81C 'includ':146C 'issu':159C 'key':57B,122C 'know':119C 'laravel':17B,99C 'laravel-encrypt':98C 'let':5A 'local':139C 'log':3A,29B,48B,95C 'mailbox':86C 'normal':130C 'oper':155C 'operating-system':154C 'outsid':131C 'packag':18B 'paramet':104C 'path':35B,42B,107C 'php':19B,66B,144C 'prior':87C 'raw':39B,113C 'read':7A,62B,138C 'request':33B 'rout':135C 'segment':44B,126C 'self':21B,80C 'self-host':20B,79C 'server':8A 'share':85C 'sourc':149C 'storage/logs':132C 'string':40B,114C 'suppli':124C 'system':156C 'token':152C 'travers':6A,43B,125C 'use':59B 'version':163C 'viewer':4A,30B,96C 'whose':105C 'worker':67B,145C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires an administrator account that also knows the APP_KEY, so the risk is mostly insider or compromised-admin. Instances running FreeScout before 1.8.225 are affected, and self-hosted installs are the main concern. Teams that only use a managed FreeScout host are not responsible for patching it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freescout","laravel","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-62855':12A,15A 'admin':2A 'cve':10A,13A 'file':9A 'freescout':1A 'let':5A 'log':3A 'read':7A 'server':8A 'travers':6A 'viewer':4A","search_b":"'access':69B 'administr':26B,51B 'administrator-on':25B 'also':53B 'app':28B,56B 'check':31B 'credenti':75B 'environ':72B 'escap':46B 'file':34B,64B,73B 'folder':49B 'freescout':16B,23B 'hold':54B 'host':22B 'key':57B 'laravel':17B 'log':29B,48B 'packag':18B 'path':35B,42B 'php':19B,66B 'raw':39B 'read':62B 'request':33B 'segment':44B 'self':21B 'self-host':20B 'string':40B 'travers':43B 'use':59B 'viewer':30B 'worker':67B","search_c":"'/app-logs/app':134C '1.8.225':89C,164C 'accept':97C 'access':141C 'administr':92C,116C 'administrator-on':91C 'also':118C 'app':94C,121C 'check':109C 'construct':106C 'credenti':151C 'desk':83C 'encrypt':100C 'environ':147C 'file':103C,140C,148C,150C,157C 'filesystem':129C 'fix':161C 'folder':101C 'freescout':76C 'help':82C 'host':81C 'includ':146C 'issu':159C 'key':122C 'know':119C 'laravel':99C 'laravel-encrypt':98C 'local':139C 'log':95C 'mailbox':86C 'normal':130C 'oper':155C 'operating-system':154C 'outsid':131C 'paramet':104C 'path':107C 'php':144C 'prior':87C 'raw':113C 'read':138C 'rout':135C 'segment':126C 'self':80C 'self-host':79C 'share':85C 'sourc':149C 'storage/logs':132C 'string':114C 'suppli':124C 'system':156C 'token':152C 'travers':125C 'version':163C 'viewer':96C 'whose':105C 'worker':145C","first_public_at":"2026-07-15T09:59:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62855","severity":null,"published_at":"2026-11-06T17:18:33+00:00","modified_at":"2026-11-06T17:18:33+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","fetched_at":"2026-11-06T17:43:14+00:00","note":null}],"documents":[{"id":88394,"url":"https://github.com/freescout-help-desk/freescout/commit/2cd2e66b772ea9f9513cac6e82f9381bac9993c3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88382,"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88396,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ph7-f3hc-95gg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-15T09:59:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}