---
id: "CVE-2026-62855"
page: "https://infrastack.ai/live/CVE-2026-62855"
kind: "vulnerability"
aliases: ["CVE-2026-62855"]
title: "FreeScout: admin log viewer lets traversal read server files"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["freescout", "laravel", "package", "php", "self-hosted"]
not_affected_if: ["managed-hosting", "version-1.8.225-or-later"]
published_at: "2026-11-06T17:18:33+00:00"
first_seen_at: "2026-11-06T17:43:14+00:00"
updated_at: "2026-11-06T17:45:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62855", "first_seen_at": "2026-11-06T17:43:14+00:00"}]
exploit_sources: []
---

# FreeScout: admin log viewer lets traversal read server files

Link for people: https://infrastack.ai/live/CVE-2026-62855 (this .md is for agents)

FreeScout's administrator-only App Logs viewer checks the requested file path only as a raw string, so path traversal segments can escape the logs folder. An administrator who also holds the APP_KEY can use this to read any file the PHP worker can access, such as environment files and credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FreeScout version against the fixed version listed below.
- Look at the FreeScout install directory for the App Logs route `/app-logs/app` and confirm which version is deployed.

## Fix

- FreeScout: `1.8.225`

## Timeline

- 2026-11-06T17:43:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62855

## Documents

- [advisory] Vendor advisory: github.com https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ph7-f3hc-95gg
- [fix] Patch: github.com https://github.com/freescout-help-desk/freescout/commit/2cd2e66b772ea9f9513cac6e82f9381bac9993c3
- [fix] Release notes: github.com https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225

## From the sources

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply traversal segments that the filesystem normalizes outside storage/logs. The /app-logs/app route can then read local files accessible to the PHP worker, including environment files, source files, credentials, tokens, and operating-system files. This issue is fixed in version 1.8.225.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_