Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M

CVE-2026-53596FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in freescout from freescout-help-desk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.

Affected products (as reported)

Vendor	Product	Versions
freescout-help-desk	freescout	< 1.8.224

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-ph4f-2jhx-q76w x_refsource_CONFIRM