Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

freescout-helpdesk/freescout

              dist @ a9572ca
            

140

Fixes

CVEs

CRITICAL

Peak severity

45.9%

Coverage

Highlights

Auth Bypass: 36 prior fixes. Scrutinize any change in this area.

app/Http/Controllers/ConversationsController.php: most-fixed (17 issues). Treat as high-risk during review.

113 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple authorization checks were missing or inverted across policies, allowing users to view, edit, delete, or reply to conversations/threads outside their assigned scope. Fixes added mailbox access checks, assigned-only restrictions, and permission negations, but sibling methods may still lack these checks.

Command Injection: shell_exec with user-controlled php_path or module alias repeatedly enabled command injection. Fixes added character blacklists, path validation, and app-key checks, but the blacklist approach is fragile and each bypass required another patch.

Stored XSS: HTML sanitization was repeatedly bypassed or incomplete—nested tags, unclosed tags, style/object tags, and form tags slipped through. Thread bodies, mailbox names, and auto-reply messages are stored and rendered, requiring robust HTMLPurifier-style sanitization on all inputs.