Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
FreeScout 1.8.206 and earlier allows malicious file uploads
CVE-2026-28289
Summary
A security issue in FreeScout's file upload feature allows authenticated users with file upload permissions to upload malicious files that can harm your server. This means an attacker could potentially take control of your server. Update to FreeScout 1.8.207 or later to fix the issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| freescout | freescout | <= 1.8.207 | – |
Original title
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user wit...
Original description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
nvd CVSS3.1
7.5
Vulnerability type
CWE-434
Unrestricted File Upload
Published: 3 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026