CVE-2026-28289

Think of FreeScout as your business’s shared inbox/help desk. This issue is like a lock that was supposed to stop dangerous file uploads, but someone can slip past it using an “invisible” character in the file name—then they may be able to run commands on the server. If your help desk staff accounts (or an attacker who got an account) can upload files, the risk is higher.

This matters if you run FreeScout and you’re using a version at or before 1.8.206. It’s most relevant when an attacker can get an account that has file upload permissions, because the weakness is triggered through uploading a specially named file. It is not a simple “visit a website and get hacked” situation; the attacker needs a valid path via upload permissions.

This is urgent because a public proof-of-concept exists and attackers could use it to turn file upload access into full server control. The vulnerability is not yet listed in CISA KEV, but the issue’s likelihood is rising and there is a confirmed vendor fix available. With the affected version window ending at 1.8.206, the fastest safe move is upgrading to the fixed release.

Confirm exposure:

• Log into FreeScout and check the installed version in the UI (commonly Help/About or an Admin “version” display).
• Confirm whether you are on 1.8.206 or earlier.

Upgrade to the fixed version:

• The fix is available in FreeScout 1.8.207.
• Perform the upgrade following your normal FreeScout maintenance process (back up your application files and database first if that’s your standard).
• After upgrade, validate that standard file upload and help desk functionality still works.

Permission hardening (while patching or if rollout is delayed):

• Reduce who has file upload permissions to only trusted staff accounts.
• Review recent accounts and roles that have access to uploads; remove any unnecessary upload access.

Verify the bypass is no longer possible:

• Use your normal file upload features to confirm uploads behave as expected after the upgrade.
• If you have a staging environment, repeat any internal test that mimics the suspicious upload naming approach (without attempting harmful payloads) to confirm the bypass no longer works.

CISA due date:

• Not applicable here because this CVE is not listed in CISA KEV based on the provided findings.

Monitor after remediation:

• Check FreeScout/application logs around the time of uploads and any unusual requests.
• Look for unexpected changes on the server related to web-accessible configuration files.

Severity is effectively critical in impact terms (remote code execution with high potential for data theft and service downtime), and the findings indicate exploitation-relevant conditions: a public proof-of-concept exists. The weakness is a patch-bypass scenario tied to CWE-434 (unintended logic/sanitization order), specifically where invisible characters can evade a dot-prefix check prior to sanitization, enabling crafting of an uploaded .htaccess filename using a zero-width space prefix. Attack vector is network-accessible file upload requiring an authenticated user with file upload permissions (not unauthenticated). Exploit maturity: weaponization is evidenced by a public PoC (1 known). KEV: not listed in CISA KEV (so no KEV-driven deadline from these findings). Fix: upgrade to 1.8.207 per vendor patch info.