CVE-2026-27636 FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache
Authenticated attackers can upload .htaccess files to achieve remote code execution on Apache servers with AllowOverride enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27636?
CVE-2026-27636 is a high-severity vulnerability in freescout-help-desk freescout, published on 25 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.
Weakness: CWE-434
Which versions are affected by CVE-2026-27636?
It affects 1 product.
Products include Freescout Freescout.
How do I fix CVE-2026-27636?
No fix has been published for CVE-2026-27636 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27636 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27636 exists.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Other vulnerabilities in freescout-help-desk freescout
- CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2024-29185 FreeScout OS Command Injection vulnerability
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron