CVE-2026-28289
CriticalSummary
FreeScout to darmowy system pomocy technicznej i wspólna skrzynka odbiorcza zbudowana na frameworku Laravel. W wersjach FreeScout 1.8.206 i wcześniejszych występuje luka umożliwiająca zdalne wykonanie kodu (RCE) poprzez przesłanie złośliwego pliku .htaccess z prefiksem znaku zerowej szerokości, co omija zabezpieczenia.
Risk Assessment
Luka ta pozwala na zdalne wykonanie kodu na serwerze przez każdego uwierzytelnionego użytkownika z uprawnieniami do przesyłania plików, co może prowadzić do poważnych naruszeń bezpieczeństwa w organizacji.
Recommendation
Zaleca się aktualizację FreeScout do wersji 1.8.207 lub nowszej, aby usunąć tę podatność oraz przegląd uprawnień użytkowników do przesyłania plików.
Related vulnerabilities
- CVE-2026-93945Critical
Deserialization of Untrusted Data vulnerability in the Balance theme by Axiomthemes allows Object Injection. This issue affects Balance from n/a through 1.12.0.
- CVE-2026-93944Critical
Deserialization of Untrusted Data vulnerability in the Camelia theme by ThemeREX Group allows Object Injection. This issue affects Camelia from n/a through 1.2.15.
- CVE-2026-93943Critical
Deserialization of Untrusted Data vulnerability in the Convex theme by ThemeREX Group allows Object Injection. This issue affects Convex from n/a through 1.16.0.
- CVE-2026-93942Critical
Deserialization of Untrusted Data vulnerability in the Dwell theme by ThemeREX Group allows Object Injection. This issue affects Dwell from n/a through 1.16.0.
- CVE-2026-93941Critical
Deserialization of Untrusted Data vulnerability in the Edema theme by ThemeREX Group allows Object Injection. This issue affects Edema from n/a through 1.2.2.2.
- CVE-2026-93940Critical
Deserialization of Untrusted Data vulnerability in the Greeny theme by ThemeREX Group allows Object Injection. This issue affects Greeny from n/a through 2.10.0.
- CVE-2026-93938Critical
Deserialization of Untrusted Data vulnerability in the Hogwords theme by ThemeREX Group allows Object Injection. This issue affects Hogwords from n/a through 1.2.7.
- CVE-2026-93937Critical
Deserialization of Untrusted Data vulnerability in the Hygia theme by ThemeREX Group allows Object Injection. This issue affects Hygia from n/a through 1.21.0.
- CVE-2026-93936Critical
Deserialization of Untrusted Data vulnerability in the IPharm theme by ThemeREX Group allows Object Injection. This issue affects IPharm from n/a through 1.2.4.
- CVE-2026-93935Critical
Deserialization of Untrusted Data vulnerability in the Let's Play theme by ThemeREX Group allows Object Injection. This issue affects Let's Play from n/a through 1.1.15.
Original NVD description (English source)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS