CVE-2025-48488

MEDIUM

freescout < 1.8.180 - Stored Cross-Site Scripting via .htaccess Deletion and HTML File Upload

Title source: llm
STIX 2.1

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file containing malicious JavaScript code to the server, which can result in a Cross-Site Scripting (XSS) vulnerability. This issue has been patched in version 1.8.180.

References (1)

Core 1
Core References

Scores

CVSS v3 5.4
EPSS 0.0022
EPSS Percentile 12.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
freescout/freescout < 1.8.180
Published May 30, 2025
Tracked Since Feb 18, 2026