Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

freescout-help-desk/freescout

              dist @ 4b17e53
            

162

Fixes

CVEs

CRITICAL

Peak severity

28.1%

Coverage

Highlights

Auth Bypass: 48 prior fixes. Scrutinize any change in this area.

app/Http/Controllers/ConversationsController.php: most-fixed (20 issues). Treat as high-risk during review.

124 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring missing or incorrect permission checks on conversation/thread operations (view, edit, delete, merge, follow, changeCustomer) across policies and controllers; multiple fixes corrected boolean logic and added mailbox/assigned-user checks, indicating systemic gaps.

SSRF: Multiple SSRF fixes in remote-fetch helpers (getRemoteFileContents, downloadRemoteFileAsTmp, get_headers) added host allowlists, IP/mask checks, redirect validation, and self-domain blocking, but each fix targeted a different bypass, suggesting incomplete coverage.

Command Injection: Repeated command injection fixes in tools.php via unsanitized php_path passed to shell_exec; each fix added one more sanitization (backticks, ampersand, path validation, DB credential check), indicating the endpoint remained vulnerable across multiple iterations.