PT-2026-34040 · Freescout · Freescout

Published 2026-04-21 · Updated 2026-04-22 · CVE-2026-41193

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.215

Description The module installation feature extracts ZIP archives without validating file paths. This allows an authenticated administrator to write files arbitrarily on the server filesystem by using a specially crafted ZIP archive, a technique known as Zip Slip (a form of directory traversal where files are extracted outside the intended destination folder).

Recommendations Update to version 1.8.215.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41193

Affected Products

Freescout

References · 8

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-r85m-5mc9-cc9w · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41193 · Security Note
• https://github.com/freescout-help-desk/freescout/commit/14f17a5cd22d217103a72b431b47b1f06996227b · Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215 · Note
• https://twitter.com/0dayPublishing/status/2046645237397725193 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046676490394251632 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046779246115266994 · Twitter Post
• https://twitter.com/CVEnew/status/2046675009897128013 · Twitter Post