CVE-2025-58163·PHP vulnerability

Affected versions

How to fix this CVE

Update FreeScout to version 1.8.186 or later to patch the unsafe deserialization vulnerability in the Laravel-based help desk application. If you are running PHP with FreeScout, ensure your installation is upgraded immediately, as the vulnerability requires only knowledge of the APP_KEY and authentication to exploit. Review your application logs for signs of exploitation and consider rotating your APP_KEY after patching.

sudo dnf update php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /help/[0-9]+/auth/[^/]+/[0-9]+/ HTTP

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block or require additional authentication for requests to endpoints matching the pattern `/help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp}`; implement strict input validation on `customer_id` and `timestamp` parameters and reject requests containing suspicious serialized PHP object signatures (e.g., strings beginning with 'O:' or 'a:' followed by class names).

How to check if you are affected

1. Check the installed PHP version with: php -v
2. Verify the FreeScout version by checking the release file or composer.lock: grep -i 'freescout' /path/to/freescout/composer.lock | head -5
3. Search application logs for requests to `/help/{mailbox_id}/auth/` endpoints: grep -E '/help/[0-9]+/auth/' /var/log/apache2/access.log
4. Confirm the patch was applied by checking that FreeScout version is >= 1.8.186: cat /path/to/freescout/VERSION or grep version /path/to/freescout/package.json

FAQ

Related PHP CVEs

References

• https://github.com/freescout-help-desk/freescout/commit/e2de65f3f32f825b4ec5558643ed81438c9a6bc6
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.186
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-j94w-q9gj-c37g