https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 14:12:03 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-53594 <p>FreeScout is a free help desk and shared inbox built with PHP&#39;s Laravel framework. FreeScout&#39;s `Manage -&gt; Logs -&gt; App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel&#39;s download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.</p> <p>FreeScout is a free help desk and shared inbox built with PHP&#39;s Laravel framework. FreeScout&#39;s `Manage -&gt; Logs -&gt; App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel&#39;s download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-53594