High severity · published Feb 25, 2026
CVE-2026-27636
FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache
8.8
CVSS
2.2%
EPSS
No
On KEV
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
freescout · freescout-help-desk
< 1.8.206 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27636
Patch
https://github.com/freescout-help-desk/freescout/commit/9984071e6f1b4e633fdcffcea82bbebc9c1e009c
Not Applicable
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6gcm-v8xf-j9v9
Exploit
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-mw88-x7j3-74vc
More from freescout
9.8
CVE-2026-40498
FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
9.8
CVE-2026-27637
FreeScout's Predictable Authentication Token Enables Account Takeover
9.8
CVE-2025-48481
FreeScout Has Business Logic Errors
9.8
CVE-2025-48471
FreeScout Vulnerable to Arbitrary File Upload
9.4
CVE-2026-53595
FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL