CVE-2026-27636

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.

• CWE-434

• https://github.com/freescout-help-desk/freescout/commit/9984071e6f1b4e633fdcffcea82bbebc9c1e009cPatch
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6gcm-v8xf-j9v9Not Applicable
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-mw88-x7j3-74vcExploit, Vendor Advisory
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6gcm-v8xf-j9v9Not Applicable
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-mw88-x7j3-74vcExploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27630TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
• CVE-2026-27631Exiv2 is a C++ library and a command-line utility to read, w…5.3
• CVE-2026-27632Talishar is a fan-made Flesh and Blood project. Prior to com…3.1
• CVE-2026-27633TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
• CVE-2026-27634Piwigo is an open source photo gallery application for the w…9.8
• CVE-2026-27635Manyfold is an open source, self-hosted web application for …8.8
• CVE-2026-27637FreeScout is a free help desk and shared inbox built with PH…9.8
• CVE-2026-27638Actual is a local-first personal finance tool. Prior to vers…7.1
• CVE-2026-27639Mercator is an open source web application designed to enabl…5.4
• CVE-2026-2764JIT miscompilation, use-after-free in the JavaScript Engine:…9.8
• CVE-2026-27640tfplan2md is software for converting Terraform plan JSON fil…7.5
• CVE-2026-27641Flask-Reuploaded provides file uploads for Flask. A critical…9.8