CVE-2026-53594

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.224

Description The Manage -> Logs -> App Logs feature uses a bundled log viewer to decrypt a user-supplied file identifier and pass the resolved path to a download response. The path resolution logic incorrectly accepts absolute paths before applying restrictions to the storage/logs directory. This allows an attacker with access to the App Logs route to download arbitrary server-local files readable by the PHP process by forging a valid Laravel-encrypted dl parameter.

Recommendations Update to version 1.8.224.