CVE-2026-53594: FreeScout Path Traversal Vulnerability

CVE-2026-53594 Overview

FreeScout is a free help desk and shared inbox application built on PHP's Laravel framework. CVE-2026-53594 is a path traversal vulnerability [CWE-22] in the Manage -> Logs -> App Logs feature. The bundled rap2hpoutre/laravel-log-viewer override decrypts a user-supplied file identifier and passes the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution accepts any existing absolute path before applying the intended storage/logs restriction. An authenticated attacker who can forge a valid Laravel-encrypted dl parameter can download arbitrary server-local files readable by the PHP process.

Critical Impact
Authenticated attackers with access to the App Logs route can read arbitrary files on the FreeScout host, exposing configuration files, credentials, and application secrets.

Affected Products

FreeScout help desk versions prior to 1.8.224
Deployments exposing the Manage -> Logs -> App Logs route to privileged users
Installations bundling the rap2hpoutre/laravel-log-viewer override

Discovery Timeline

2026-07-20 - CVE-2026-53594 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-53594

Vulnerability Analysis

The flaw resides in FreeScout's override of the rap2hpoutre/laravel-log-viewer component. The App Logs feature accepts a dl query parameter containing a Laravel-encrypted file identifier. The application decrypts this identifier to determine which log file to serve for download.

The path resolution routine validates that the decrypted path points to an existing file before enforcing the intended storage/logs directory restriction. Because the check occurs in the wrong order, any absolute path that resolves to an existing file is accepted. The final download response then streams the file contents to the requester.

An attacker who has access to the App Logs route and can craft a valid encrypted dl value can retrieve any file readable by the PHP process user. This includes .env files containing database credentials, application keys, mail server passwords, and OAuth secrets used by FreeScout mailbox integrations.

Root Cause

The root cause is improper ordering of validation logic in the log file resolver. The code confirms file existence on the absolute path before constraining the path to storage/logs. This TOCTOU-adjacent flaw allows arbitrary paths to bypass the directory restriction entirely.

Attack Vector

Exploitation requires network access to the FreeScout application and the ability to reach the App Logs administrative route, which typically requires high privileges. The attacker must also possess or forge a valid Laravel-encrypted dl parameter, which requires knowledge of the APP_KEY or an existing valid ciphertext to manipulate. Once these conditions are met, the attacker submits a crafted dl value pointing to any target file such as /etc/passwd, /var/www/freescout/.env, or private key material stored on disk. The server responds with the file contents as a download.

Refer to the GitHub Security Advisory GHSA-858x-8f77-9vc5 for authoritative technical details.

Detection Methods for CVE-2026-53594

Indicators of Compromise

Requests to the App Logs download endpoint containing unusual or unexpected dl parameter values
Web server logs showing successful downloads from the log viewer route paired with response sizes inconsistent with typical log files
Access to sensitive files such as .env, SSH keys, or system files in filesystem audit logs correlated to the PHP-FPM or web server process

Detection Strategies

Enable Laravel and web server access logging for all requests to /logs, /manage/logs, and any App Logs download routes, then alert on high volumes or off-hours access
Deploy file integrity and access monitoring on sensitive files such as .env, private keys, and configuration directories to detect unexpected reads by the PHP process
Review FreeScout audit logs for administrative sessions accessing the App Logs feature outside normal operational patterns

Monitoring Recommendations

Correlate administrator authentication events with subsequent App Logs downloads to identify credential compromise
Monitor egress traffic volumes from the FreeScout host for anomalous data transfers indicative of bulk file exfiltration
Track changes to the APP_KEY value and any use of Laravel encryption utilities outside the application runtime

How to Mitigate CVE-2026-53594

Immediate Actions Required

Upgrade FreeScout to version 1.8.224 or later, which contains the official fix
Rotate the Laravel APP_KEY and all secrets stored in .env if arbitrary file read may have occurred
Restrict access to the App Logs feature to a minimal set of trusted administrators and review current role assignments

Patch Information

The FreeScout maintainers released version 1.8.224 to address CVE-2026-53594. The fix corrects the path resolution logic so that the storage/logs restriction is enforced before file existence checks. See the FreeScout Security Advisory GHSA-858x-8f77-9vc5 for release details.

Workarounds

Block access to the App Logs download route at the reverse proxy or web application firewall until the upgrade is applied
Run the PHP process under a dedicated low-privilege user with filesystem access limited to the FreeScout application directory
Remove read permissions on sensitive files such as .env for the PHP process user where operationally feasible

bash

# Example nginx rule to block the App Logs download endpoint pending upgrade
location ~* ^/(manage/)?logs {
    deny all;
    return 403;
}