CVE-2026-41193 FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE
An authenticated admin can achieve remote code execution by uploading a malicious ZIP module that writes arbitrary files to the server filesystem.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41193?
CVE-2026-41193 is a critical path traversal vulnerability in freescout-help-desk freescout, published on 21 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP. Version 1.8.215 fixes the vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2026-41193?
How do I fix CVE-2026-41193?
No fix has been published for CVE-2026-41193 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-41193 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41193 exists.
Sources
Also known as GHSA-r85m-5mc9-cc9w.