Executive brief
FreeScout is an open-source help desk and shared inbox platform. A vulnerability in the file upload system allows an attacker to flood the server with an unlimited number of files. This can lead to a complete service outage, database crashes, and exhausted storage space, preventing legitimate customers and staff from using the help desk.
Technical details
The FreeScout help desk application (built on Laravel) lacks rate limiting, per-user quotas, or CAPTCHA protections on its file upload endpoint. An attacker can send a high volume of concurrent upload requests over the network without authentication (or as a low-privileged user). Each request results in new database records and disk storage consumption. This uncontrolled resource consumption (CWE-400/CWE-770) leads to database I/O overload and disk space exhaustion, resulting in a Denial of Service (DoS) condition. The issue is resolved in version 1.8.224.
Affected products
- freescout-help-desk FreeScout < 1.8.224
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD