CVE-2025-48471
📋 TL;DR
FreeScout versions before 1.8.179 have an unrestricted file upload vulnerability that allows attackers to upload malicious PHP files (.phtml, .phar extensions) to the web server. When Apache is used, this can lead to remote code execution, potentially giving attackers full control of the server. All FreeScout instances running vulnerable versions with Apache are affected.
💻 Affected Systems
- FreeScout
📦 What is this software?
Freescout by Freescout
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining shell access, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to web shell deployment, data theft, and potential ransomware deployment.
If Mitigated
File uploads blocked or properly validated, preventing malicious file execution.
🎯 Exploit Status
Simple file upload with malicious extension. Public exploit code exists in advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.179
Vendor Advisory: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-h2f3-932h-v38j
Restart Required: No
Instructions:
1. Backup your FreeScout instance and database. 2. Update to version 1.8.179 via git pull or manual download. 3. Run any database migrations if required. 4. Clear application cache.
🔧 Temporary Workarounds
Apache Configuration Restriction
linuxConfigure Apache to not execute .phtml and .phar files
Add to .htaccess or Apache config: <FilesMatch "\.(phtml|phar)$">
Deny from all
</FilesMatch>
Web Application Firewall Rule
allBlock uploads of .phtml and .phar files at WAF level
🧯 If You Can't Patch
- Disable file upload functionality entirely in FreeScout configuration
- Migrate to different web server that doesn't execute .phtml/.phar by default
🔍 How to Verify
Check if Vulnerable:
Check if version is below 1.8.179 and test uploading .phtml file (use harmless test file)Check Version:
Check app/version.php or run: php artisan --version (if configured)Verify Fix Applied:
Attempt to upload .phtml file - should be rejected. Verify version is 1.8.179 or higher.📡 Detection & Monitoring
Log Indicators:
- File uploads with .phtml or .phar extensions in web server logs
- Unusual POST requests to upload endpoints
- Execution of unexpected PHP files
Network Indicators:
- POST requests with file uploads to FreeScout endpoints
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="apache_access" AND (uri_path="*upload*" OR uri_path="*.phtml" OR uri_path="*.phar")