CVE-2026-28289

CVE-2026-28289 is a patch-bypass flaw in FreeScout, a self-hosted PHP/Laravel help desk and shared inbox, that reintroduces the remote code execution previously fixed under CVE-2026-27636. The bug is a time-of-check to time-of-use (TOCTOU) issue in the sanitizeUploadedFileName() function in app/Http/Helper.php: the check for a dot-prefixed filename runs before sanitization strips invisible characters, so a filename beginning with a zero-width space followed by .htaccess passes the security check and is stored as a functional .htaccess file in the upload directory. Any authenticated user with file-upload permissions can exploit this by uploading such a crafted .htaccess file, overriding Apache configuration for the upload path and achieving remote code execution on the server; related reporting also describes an unauthenticated, zero-click vector via emailed attachments. All FreeScout deployments running version 1.8.206 or earlier are affected, and the flaw is fixed in 1.8.207. Exploitation status: public proof-of-concept material and analysis are available (EPSS ~31%, 98th percentile), it is not yet in CISA's KEV catalog, and active in-the-wild exploitation has not been explicitly confirmed in the provided data.

What to do: Upgrade FreeScout to version 1.8.207 or later. As interim mitigation, restrict file-upload permissions to trusted users, disallow or ignore .htaccess overrides in upload directories (e.g., Apache AllowOverride None), and audit existing upload directories for .htaccess files or filenames containing zero-width/invisible characters.