PT-2026-22809 · Laravel+1 · Laravel+1

Mosesox + 1 · Published 2026-03-03 · Updated 2026-04-03 · CVE-2026-28289

Positive Technologies · (AI Summary)

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeScout versions 1.8.206 and earlier

Description FreeScout is susceptible to remote code execution (RCE) vulnerabilities (CVE-2026-27636 and CVE-2026-28289). CVE-2026-27636 allows authenticated users with file upload permissions to execute code by uploading a malicious .htaccess file with a zero-width space character prefix, bypassing security checks due to a Time-of-Check to Time-of-Use (TOCTOU) flaw in the sanitizeUploadedFileName() function within app/Http/Helper.php. CVE-2026-28289 enables unauthenticated, zero-click RCE via email by exploiting a filename validation bypass using the same zero-width space character. Attackers can send a crafted email to any FreeScout mailbox, leading to remote code execution and potential server takeover. The vulnerability bypasses a previous security patch.

Recommendations Update to version 1.8.207 to address these vulnerabilities.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-28289

GHSA-5GPC-65P8-FFWP

Affected Products

Freescout

Laravel

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28289.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5gpc-65p8-ffwp · Vendor Advisory
• https://github.com/freescout-help-desk/freescout/commit/f7bc16c56a6b13c06da52ad51fd666546b40818f · Patch
• https://osv.dev/vulnerability/CVE-2026-28289 · Vendor Advisory
• https://ox.security/blog/freescout-rce-cve-2026-28289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28289 · Security Note
• https://twitter.com/cybernewslive/status/2029169712093864049 · Twitter Post
• https://twitter.com/cybernewslive/status/2029660557385629988 · Twitter Post
• https://twitter.com/shah_sheikh/status/2029518637665767560 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2029392781148377185 · Twitter Post
• https://twitter.com/lordman1982/status/2033498737650082042 · Twitter Post
• https://t.me/cveNotify/155164 · Telegram Post
• https://t.me/CVEtracker/46262 · Telegram Post
• https://twitter.com/TheHackerWire/status/2029101764042235946 · Twitter Post
• https://twitter.com/CVEnew/status/2028974428483109103 · Twitter Post