CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path
An attacker with access to the App Logs route can forge an encrypted parameter to download arbitrary server files, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53594?
CVE-2026-53594 is a medium-severity path traversal vulnerability in freescout-help-desk freescout, published on 20 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.
Weakness: CWE-22
Which versions are affected by CVE-2026-53594?
How do I fix CVE-2026-53594?
No fix has been published for CVE-2026-53594 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-53594 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53594 exists.
Sources
Also known as GHSA-858x-8f77-9vc5.