CVE-2026-28289: FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution

High severity · published Mar 3, 2026

CVE-2026-28289

FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution

8.1

CVSS

34.9%

EPSS

On KEV

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)34.9% · higher than 98% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

freescout · freescout-help-desk

< 1.8.207 · source: vendor, NVD

In the news

VulnerabilityCritical

FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289)

A newly discovered vulnerability (CVE-2026-28289) in the open-source help desk platform FreeScout could allow attackers to take over vulnerable servers by sending a specially crafted email to a FreeScout mailbox. CVE-2026-28289 exploitation FreeScout is a free, open-source help desk and shared inbox system used by businesses or teams to manage customer support conversations in one place. It is built with PHP (Laravel) and MySQL, and it’s designed to be self-hosted – either on-premises, on a … More → The post FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289) appeared first on Help Net Security .

CVE-2026-28289

Mar 5, 2026·Help Net Security

Affected product

freescout

freescout-help-desk

All freescout CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-28289

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-28289

Patch

https://github.com/freescout-help-desk/freescout/commit/f7bc16c56a6b13c06da52ad51fd666546b40818f

Exploit

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5gpc-65p8-ffwp

Exploit

https://www.ox.security/blog/freescout-rce-cve-2026-28289/