CVE-2026-28289 Details
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
A remote code execution vulnerability has been identified in FreeScout versions through 1.8.206. This issue arises from a patch bypass for a previous vulnerability (CVE-2026-27636), allowing any authenticated user with file upload permissions to execute arbitrary code on the server. The vulnerability is rooted in the 'sanitizeUploadedFileName()' function within 'app/Http/Helper.php', where a Time-of-Check to Time-of-Use (TOCTOU) flaw enables the exploitation. By uploading a malicious '.htaccess' file prefixed with a zero-width space character to evade security checks, the vulnerability can be exploited, especially on Apache servers with 'AllowOverride All' enabled.
Users can upgrade to FreeScout version 1.8.207, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.ox.security/blog/freescout-rce-cve-2026-28289/ | CVE | ExploitVendor Advisory |
| https://github.com/freescout-help-desk/freescout/commit/f7bc16c56a6b13c06da52ad51fd666546b40818f | [email protected] | Patch |
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5gpc-65p8-ffwp | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freescout freescout | < 1.8.207 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Modified Analysis | [email protected] |
| Mar 5, 2026 | CVE Modified | CVE |
| Mar 5, 2026 | Initial Analysis | [email protected] |
| Mar 3, 2026 | New CVE Received | [email protected] |