CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
Authenticated users can achieve remote code execution by uploading a malicious .htaccess file using zero-width space characters to bypass security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28289?
CVE-2026-28289 is a critical vulnerability in freescout-help-desk freescout, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
Weakness: CWE-434
Which versions are affected by CVE-2026-28289?
It affects 1 product.
Products include Freescout Freescout.
How do I fix CVE-2026-28289?
No fix has been published for CVE-2026-28289 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-28289 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28289 exists.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Other vulnerabilities in freescout-help-desk freescout
- CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2024-29185 FreeScout OS Command Injection vulnerability
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
- CVE-2026-40496 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force
Sources
Also known as GHSA-5gpc-65p8-ffwp.