FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-27636 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities. NVD description · AI analysis pending | 8.8 | 2% | PoC |
| — | |
| CVE-2026-28289 | Authenticated RCE via .htaccess Upload Bypass in FreeScout 1.8.206 and Earlier CVE-2026-28289 is a patch-bypass flaw in FreeScout, a self-hosted PHP/Laravel help desk and shared inbox, that reintroduces the remote code execution previously fixed under CVE-2026-27636. The bug is a time-of-check to time-of-use (TOCTOU) issue in the sanitizeUploadedFileName() function in app/Http/Helper.php: the check for a dot-prefixed filename runs before sanitization strips invisible characters, so a filename beginning with a zero-width space followed by .htaccess passes the security check and is stored as a functional .htaccess file in the upload directory. Any authenticated user with file-upload permissions can exploit this by uploading such a crafted .htaccess file, overriding Apache configuration for the upload path and achieving remote code execution on the server; related reporting also describes an unauthenticated, zero-click vector via emailed attachments. All FreeScout deployments running version 1.8.206 or earlier are affected, and the flaw is fixed in 1.8.207. Exploitation status: public proof-of-concept material and analysis are available (EPSS ~31%, 98th percentile), it is not yet in CISA's KEV catalog, and active in-the-wild exploitation has not been explicitly confirmed in the provided data. Do: Upgrade FreeScout to version 1.8.207 or later. As interim mitigation, restrict file-upload permissions to trusted users, disallow or ignore .htaccess overrides in upload directories (e.g., Apache AllowOverride None), and audit existing upload directories for .htaccess files or filenames containing zero-width/invisible characters. | 8.1 | 31% | PoC ×2 |
| moderatelikely on the order of low thousands of internet-reachable self-hosted instances (no public install counts; estimate) |
Full article536 words · extracted from helpnetsecurity.com · click to collapse
A newly discovered vulnerability (CVE-2026-28289) in the open-source help desk platform FreeScout could allow attackers to take over vulnerable servers by sending a specially crafted email to a FreeScout mailbox.
CVE-2026-28289 exploitation
FreeScout is a free, open-source help desk and shared inbox system used by businesses or teams to manage customer support conversations in one place.
It is built with PHP (Laravel) and MySQL, and it’s designed to be self-hosted – either on-premises, on a cloud server, or a virtual private server.
CVE-2026-28289 is a bypass of the patch for CVE-2026-27636, which was fixed in FreeScout v1.8.206 and stemmed from its file upload restriction list not including .htaccess or .user.ini files.
(.htaccess files are configuration file used on Apache-based web servers to manage website behavior on a per-directory basis, and .user.ini files allow users to change the configuration of PHP on a per-app and per-directory basis.)
“On Apache servers with AllowOverride All (a common configuration), an authenticated user can upload a .htaccess file to redefine how files are processed, enabling Remote Code Execution,” it’s been explained.
OX Security researchers found that the fix for CVE-2026-27636 attempts to prevent dangerous file uploads by appending an underscore to the file extension when a filename either uses a restricted extension or begins with a period (‘.’).
“During code review, we found a way to bypass this filename validation by prepending a Zero-Width Space character (Unicode U+200B) to the filename,” they shared.
“Because U+200B is not treated as visible content during the initial check, it allows a filename to bypass the validation that blocks names starting with ‘.’ Later in the processing chain, the U+200B character is stripped, causing the file to be saved as a true dotfile, despite having passed the earlier validation.”
They also devised a way to exploit CVE-2026-28289 remotely, without authentication or any required user interaction, by simply sending an email carrying a malicious .htaccess file and a webshell to a mailbox configured in FreeScout.
How the attack unfolds (Source: OX Research)
The malicious payload is written to disk on the FreeScout server and, since the location where it’s saved is predictable, attackers can access it on the server’s web GUI and use it to execute commands remotely.
What to do?
According to OX Security researchers, the Shodan search engine currently shows around 1100 publicly exposed FreeScout instances. Whether all of them are vulnerable to CVE-2026-28289 is unknown.
But those that are risk system takeover and data exfiltration (helpdesk tickets, mailbox content, etc.). Attackers could also use the compromised system to move laterally through the same network.
“Our investigation confirmed exposed FreeScout deployments across public health institutions, technology providers, financial services platforms, and news organizations. We are intentionally withholding identifying details to avoid increasing risk to affected parties,” the researchers added.
If you’re using FreeScout for your help desk needs, are running the instance on Apache Server, and you have not updated your instance since last week, you should get on it right away and upgrade to v1.8.207.
The researchers also advise disabling AllowOverrideAll in the Apache configuration on the FreeScout server.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/03/05/freescout-vulnerability-cve-2026-28289/