CVE-2025-48487 Overview
FreeScout is a self-hosted help desk and shared mailbox application. CVE-2025-48487 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting FreeScout versions prior to 1.8.180. The flaw resides in the translation feature. When a user creates a translation for a phrase that later appears in a flash message after a completed action, an attacker with translation privileges can inject a JavaScript payload. The payload executes in the browser of any user who triggers the associated action. The maintainers patched the issue in version 1.8.180.
Critical Impact
Authenticated users with translation permissions can inject persistent JavaScript into flash messages, enabling session hijacking and account takeover of other FreeScout users.
Affected Products
- FreeScout versions prior to 1.8.180
- Self-hosted FreeScout help desk deployments
- Multi-user FreeScout instances exposing translation functionality
Discovery Timeline
- 2025-05-30 - CVE-2025-48487 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48487
Vulnerability Analysis
The vulnerability is a stored XSS flaw in FreeScout's localization subsystem. FreeScout allows privileged users to create and edit translations of UI strings. Some of these translated strings are rendered inside flash messages that appear after a user completes an action such as saving a record or submitting a form.
The translation input accepts arbitrary content and the resulting translated string is rendered without proper output encoding when displayed in a flash message. An attacker who can submit translations can therefore embed HTML and JavaScript. When a victim user performs the action associated with that translated phrase, the injected script executes in the victim's browser session.
Because flash messages render in the authenticated application context, successful exploitation yields access to the victim's session cookies, cross-site request forgery (CSRF) tokens, and any data accessible through the help desk interface. Impact scales with the victim's privileges, enabling escalation when an administrator triggers the affected action.
Root Cause
The root cause is missing or inadequate output encoding of translated phrases when FreeScout renders them inside flash message templates. User-controlled translation content reaches the HTML sink without being treated as untrusted data.
Attack Vector
Exploitation requires an authenticated account with high privileges to submit a translation containing a malicious payload. A second user must then perform the action that triggers the flash message. The payload executes in that user's browser within the FreeScout origin. See the FreeScout GitHub Security Advisory GHSA-wg2q-m2fj-x6j4 for additional detail.
Detection Methods for CVE-2025-48487
Indicators of Compromise
- Translation records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the translated string column.
- Unexpected outbound requests from browsers of FreeScout users to attacker-controlled domains following flash message events.
- Audit log entries showing translation edits by accounts that do not normally perform localization work.
Detection Strategies
- Review the FreeScout translations database table for entries containing angle brackets, javascript: schemes, or event handler attributes.
- Inspect web server access logs for POST requests to translation endpoints followed by anomalous session activity.
- Monitor browser Content Security Policy (CSP) violation reports for inline script executions originating from the FreeScout origin.
Monitoring Recommendations
- Enable and centralize FreeScout application and web server logs in a SIEM for correlation of translation edits with subsequent user activity.
- Alert on administrative accounts whose sessions issue unexpected API calls shortly after loading pages that render flash messages.
- Track the FreeScout version string across all hosted instances to confirm that 1.8.180 or later is deployed.
How to Mitigate CVE-2025-48487
Immediate Actions Required
- Upgrade FreeScout to version 1.8.180 or later on all production and staging instances.
- Audit existing translation entries and remove any strings containing HTML, script tags, or JavaScript URI schemes.
- Rotate session cookies and force re-authentication of all users after patching if suspicious translations are found.
- Review the privilege level required to edit translations and remove the role from accounts that do not need it.
Patch Information
The maintainers fixed the vulnerability in FreeScout 1.8.180. Refer to the FreeScout GitHub Security Advisory GHSA-wg2q-m2fj-x6j4 for the official advisory and patch commit.
Workarounds
- Restrict translation editing permissions to a minimal set of trusted administrators until the upgrade is applied.
- Deploy a strict Content Security Policy that disallows inline script execution to reduce the impact of injected payloads.
- Place FreeScout behind a web application firewall (WAF) with rules that block common XSS payloads in POST bodies to translation endpoints.
# Example Content-Security-Policy header to limit inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
