Not scored
CVE-2026-27636
FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache
freescout-help-deskfreescout
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
2.2%probability of exploitation in the next 30 days
Higher than 83% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 4 Mar · 09:30 UTC | SecurityWeek | FreeScout CVE-2026-28289 enables unauth RCE via TOCTOU bypass |
| Thu 5 Mar · 11:28 UTC | Infosecurity | FreeScout CVE-2026-28289 enables zero click RCE via crafted email |
- FreeScout CVE-2026-28289 enables zero click RCE via crafted emailInfosecurity
- FreeScout CVE-2026-28289 enables unauth RCE via TOCTOU bypassSecurityWeek · first in our coverage · mentions it in passing