FreeScout’s App Logs viewer, part of a free help‑desk platform built on Laravel, utilizes the rap2hpoutre/laravel-log-viewer override to decrypt a user‑supplied file identifier and then forwards the resolved path to Laravel’s download response. Before version 1.8.224, the path resolution logic first accepts any existing absolute path and then applies the intended storage/logs restriction. This flaw allows an attacker who can access the App Logs route and forge a valid Laravel‑encrypted dl parameter to download arbitrary server‑local files that are readable by the PHP process—not just log files. The vulnerability is an arbitrary file read that can expose sensitive configuration or source code, thereby compromising confidentiality.

The vulnerable implementation exists in the FreeScout help‑desk application. Versions prior to 1.8.224, i.e., 1.8.223 and earlier releases, are affected.

The CVSS score of 4.9 indicates moderate severity. The EPSS score of less than 1 % (approximately 0.00351) indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have access to the App Logs route and to be able to generate a valid Laravel‑encrypted download parameter, implying that authenticated or route‑visible actors can use the flaw. Once accessed, the attacker can read any file the web process can access, exposing sensitive configuration data or source code and thus compromising confidentiality.