FreeScout CVE-2026-53594

Exploitation requires an authenticated session with access to the FreeScout Manage -> Logs -> App Logs route, which corresponds to high-privilege (admin-level) access as reflected by PR:H in the CVSS vector. The attacker must additionally be able to forge a valid Laravel-encrypted dl parameter - in practice, this means either possessing the Laravel application key (APP_KEY) or operating within an active authenticated session where they can observe and manipulate the encrypted value. Only files that are readable by the PHP web server process can be retrieved; files owned exclusively by root or other system users with restricted permissions are not accessible. Limiting factors: requires admin authentication, requires ability to construct or manipulate Laravel-encrypted values, and impact is restricted to files the web process user can read.

The CVSS 3.1 score of 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately reflects the primary limiting factor: exploitation requires high-privilege authenticated access to the App Logs route. While the network attack vector and low complexity would ordinarily increase urgency, the PR:H requirement substantially narrows the realistic attacker population to users who have already obtained admin-level credentials or sessions. The confidentiality impact is rated High because arbitrary server file read can expose .env files, database credentials, or private keys - making post-exploitation impact severe despite the moderate base score. No EPSS data was provided in the input, KEV status is absent (not confirmed), and no POC has been reported - these signals collectively suggest opportunistic exploitation is not currently observed. Real-world priority is moderate: patching is straightforward (a single version upgrade), and the primary risk scenario involves credential-compromised admin accounts rather than unauthenticated attackers.

An attacker who has obtained FreeScout administrator credentials - through credential stuffing, phishing, or a prior compromise - authenticates and navigates to the App Logs page. They intercept or craft a request with a forged Laravel-encrypted dl parameter pointing to a sensitive absolute path such as /var/www/freescout/.env, which contains the database password and application key. Because path validation occurs after resolution, the application serves the .env file as a direct download, enabling further compromise of backend systems.