CVE-2025-48875: FreeScout Help Desk XSS Vulnerability

CVE-2025-48875 Overview

CVE-2025-48875 is a stored Cross-Site Scripting (XSS) vulnerability in FreeScout, a self-hosted help desk and shared mailbox application. The flaw exists in versions prior to 1.8.181 and stems from improper validation of the first_name and last_name fields during profile data updates. An authenticated attacker can inject arbitrary JavaScript into these fields. The payload executes inside a flash message when the profile data is later deleted. The issue is tracked as CWE-79 and was fixed in version 1.8.181.

Critical Impact
Authenticated attackers can inject persistent JavaScript into FreeScout profile fields, executing arbitrary script in another user's browser session when profile data is deleted.

Affected Products

FreeScout versions prior to 1.8.181
Self-hosted FreeScout help desk deployments
Shared mailbox installations using vulnerable FreeScout builds

Discovery Timeline

2025-05-30 - CVE-2025-48875 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48875

Vulnerability Analysis

FreeScout accepts user profile updates through the User::setData() method in app/User.php. Prior to version 1.8.181, the method stored the submitted first_name and last_name values without stripping HTML or script tags. The sanitized values are later rendered inside flash messages, a UI component typically used to confirm actions such as record deletion. When an administrator or another user deletes the attacker-controlled profile data, the stored payload is rendered into the DOM without encoding, triggering script execution in the victim's browser session.

Root Cause

The root cause is missing input sanitization on profile fields that are later interpolated into HTML responses. The affected fields include first_name, last_name, phone, and timezone. Because FreeScout rendered the flash message content as HTML, any tag injected into those fields produced executable markup.

Attack Vector

Exploitation requires an authenticated account with permission to update a profile. The attacker submits a crafted name value containing a script payload. The payload remains dormant until the stored profile record is deleted, at which point the flash message renders the payload in a privileged user's browser. User interaction is required to trigger execution, which aligns with the published CVSS vector.

php

            $data['password'] = \Hash::make($data['password']);
        }

+        // Strip tags.
+        $fields_strip = [
+            'first_name',
+            'last_name',
+            'phone',
+            'timezone',
+        ];
+
+        foreach ($fields_strip as $field) {
+            if (in_array($field, array_keys($data))) {
+                $data[$field] = strip_tags($data[$field]);
+            }
+        }
+
        if ($replace_data) {
            $this->fill($data);
        } else {

Source: FreeScout patch commit 508dda1. The patch introduces a strip_tags() call on each affected field within User::setData(), removing HTML markup before persistence.

Detection Methods for CVE-2025-48875

Indicators of Compromise

Profile records with HTML tags, <script> elements, or event handlers (onerror, onload) stored in first_name or last_name columns.
Unexpected JavaScript execution or redirects observed by help desk operators after deleting a user or contact profile.
Database rows in the users table containing angle brackets or URL-encoded script fragments in name fields.

Detection Strategies

Query the FreeScout users table for name or phone fields containing <, >, javascript:, or encoded equivalents.
Review application and web server access logs for POST requests to profile update endpoints containing script-like payloads.
Audit administrative actions that triggered flash messages shortly before anomalous client-side behavior was reported.

Monitoring Recommendations

Enable logging on all profile edit and delete routes and forward logs to a centralized analytics platform for inspection.
Alert on outbound requests from help desk operator browsers to unknown domains, which can indicate successful XSS payload execution.
Track the installed FreeScout version across environments and alert on any instance running a build older than 1.8.181.

How to Mitigate CVE-2025-48875

Immediate Actions Required

Upgrade FreeScout to version 1.8.181 or later across all production and staging environments.
Audit the users table for stored HTML or JavaScript in first_name, last_name, phone, and timezone fields and sanitize existing records.
Restrict profile edit permissions to trusted accounts until patching is complete.

Patch Information

The maintainers fixed the vulnerability in FreeScout 1.8.181 via commit 508dda1. The patch sanitizes profile fields with strip_tags() inside User::setData(). Full details are available in the GitHub Security Advisory GHSA-mjjx-rv96-w9hq.

Workarounds

Apply the upstream patch manually to app/User.php if an immediate upgrade is not feasible.
Deploy a Content Security Policy (CSP) that disallows inline script execution to reduce the impact of stored XSS payloads.
Place the FreeScout application behind a web application firewall rule set that blocks script tags and common XSS payloads in profile update requests.

bash

# Example CSP header to limit inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";