CVE-2025-48471 is a critical unrestricted file upload flaw (CVSS 9.8) in FreeScout, the self-hosted help desk. Before version 1.8.179, files with phtml and phar extensions could be uploaded, which can lead to remote code execution when Apache is the web server. Upgrade to 1.8.179 or later.
What's affected
Per the CVE record and the GitHub advisory, FreeScout versions before 1.8.179 are affected, and 1.8.179 contains the fix. The advisory names versions 1.8.173 and 1.8.174 as the ones it tested.
The cause, as the advisory describes it, is that the application checks uploaded file names against a restricted list of extensions that did not cover the phtml and phar extensions. The record says that can lead to remote code execution if the Apache web server is used.
The advisory lists the exploitation conditions as an authorized user and an Apache web server. The NVD vector below says no privileges are required, so the two sources do not agree on that point. Plan as though a low level help desk account is enough, and do not rely on the privilege requirement for safety.
The record files this under CWE-434 (Unrestricted Upload of File with Dangerous Type). The base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no interaction, with high impact on confidentiality, integrity and availability.
How to check if you're exposed
Find your FreeScout version in the admin area, which shows the application version, or, if you installed from Git:
git describe --tags
Anything before 1.8.179 is affected. Then check the web server. The record ties the code execution to Apache, so check how your server handles files with the phtml and phar extensions in upload folders. Many Apache setups map those extensions to the PHP handler by default.
Next, look in the upload folders for files with those extensions:
find /path/to/freescout/storage /path/to/freescout/public -type f ( -name "*.phtml" -o -name "*.phar" ) 2>/dev/null
Any hit that you did not put there needs investigation. Finally, review who has accounts on the help desk, since the advisory says an authorized user is needed.
What to do now
- Upgrade FreeScout to 1.8.179 or later. If you can, move to the newest release, which also includes the fix for CVE-2025-48481.
- Search upload and storage folders for phtml and phar files, and investigate any you did not expect.
- Configure the web server so upload folders cannot run scripts, whatever their extension.
- Review help desk accounts, remove any you do not recognise, and require strong passwords and two-factor authentication.
- Run the web server and PHP under a low privilege account with write access only where it is needed.
- If you find a stray script file, treat the host as possibly compromised, rotate secrets stored on it, and review mail and database access.
Why it matters
Unrestricted file upload is dangerous because the server may do more with a file than store it. If an uploaded file can be reached by URL and the web server treats its extension as executable, then the file becomes a program that runs with the permissions of the web application. That is how the record connects an upload check to remote code execution.
A blocklist of bad extensions is a weak design, because there are many extensions a server may execute, and the list has to be complete forever. Safer designs allow only known good types, store uploads outside the web root or in a folder that never executes, and rename the files on the way in.
It is not listed in the CISA Known Exploited Vulnerabilities catalog, and the record does not report exploitation in the wild. Help desks hold customer mail, contact details and often credentials sent in tickets, so a takeover of the web host is a serious event for the whole business.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need Apache for this to matter?
The record ties code execution to Apache. Other servers may handle those extensions differently, but upgrade whichever server you use.
Does the attacker need an account?
The advisory says an authorized user, while the NVD vector says no privileges. Assume a low-level account is enough.
Sources
- NVD record for CVE-2025-48471
- FreeScout GitHub security advisory GHSA-h2f3-932h-v38j
- FreeScout fix commit (listed in the record)
Last reviewed: 18 October 2026.
