CVE-2026-28289: Php [PoC]

Overview

A critical security vulnerability has been identified in FreeScout, a widely used help desk and shared inbox application. This flaw allows any authenticated user with basic file upload permissions to take complete control of the server hosting the application.

Vulnerability Explanation

In simple terms, the vulnerability is a bypass of a previous security fix. The application’s security check for uploaded files contains a timing flaw. When a user uploads a file, the system checks if the filename is dangerous (like .htaccess, a powerful configuration file) before it fully cleans the name. An attacker can exploit this gap by using a hidden, zero-width space character at the start of the filename (e.g., [zero-width-space].htaccess). The initial check doesn’t see the dangerous .htaccess part, but later steps remove the invisible character, leaving the malicious file in place. This allows the attacker to upload a harmful .htaccess file to execute arbitrary code on the server.

Potential Impact

The impact of this vulnerability is severe (CRITICAL, CVSS 10.0). A successful exploit leads to Remote Code Execution (RCE). This means an attacker with a standard user account in the help desk can:

• Gain full administrative control over the web server.
• Steal, modify, or delete sensitive customer support data and emails.
• Use the compromised server to attack other internal systems.
• Install persistent backdoors or malware.

Remediation and Mitigation

Immediate action is required for all FreeScout administrators.

Primary Fix:

• Upgrade immediately to FreeScout version 1.8.207 or later. This is the only complete solution, as it fixes the logic flaw in the sanitizeUploadedFileName() function.

Immediate Mitigation (If Upgrade is Delayed):

1. Restrict File Uploads: Review and minimize the number of user roles with file upload permissions. Apply the principle of least privilege.
2. Web Server Hardening: Configure your web server (e.g., Apache, Nginx) to block direct access to, or execution of, .htaccess files in user upload directories.
3. Monitor Logs: Closely monitor application and server logs for any unusual file upload activity, particularly attempts to upload files with dot-prefixes.

All users on versions 1.8.206 and earlier are vulnerable and should treat this patch as an urgent priority.