CVE-2026-28289

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.

• CWE-434

• https://github.com/freescout-help-desk/freescout/commit/f7bc16c56a6b13c06da52ad51fd666546b40818fPatch
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5gpc-65p8-ffwpExploit, Mitigation, Vendor Advisory
• https://www.ox.security/blog/freescout-rce-cve-2026-28289/Exploit, Vendor Advisory

Published

Mar 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28281InstantCMS is a free and open source content management syst…7.1
• CVE-2026-28282Discourse is an open-source discussion platform. Versions pr…6.5
• CVE-2026-28284FreePBX is an open source IP PBX. Prior to versions 16.0.10 …8.8
• CVE-2026-28286ZimaOS is a fork of CasaOS, an operating system for Zima dev…9.9
• CVE-2026-28287FreePBX is an open source IP PBX. From versions 16.0.17.2 to…8.8
• CVE-2026-28288Dify is an open-source LLM app development platform. Prior t…5.3
• CVE-2026-28291simple-git enables running native Git commands from JavaScri…8.1
• CVE-2026-28292`simple-git`, an interface for running git commands in any n…9.8
• CVE-2026-28295A flaw was found in the FTP GVfs backend. A malicious FTP se…4.3
• CVE-2026-28296A flaw was found in the FTP GVfs backend. A remote attacker …4.3
• CVE-2026-28297SolarWinds Observability Self-Hosted was found to be affecte…8.7
• CVE-2026-28298SolarWinds Observability Self-Hosted was found to be affecte…8.1