CVE-2026-27636: Freescout Help Desk RCE Vulnerability

CVE-2026-27636 Overview

CVE-2026-27636 is a critical unrestricted file upload vulnerability affecting FreeScout, a popular open-source help desk and shared inbox application built on PHP's Laravel framework. The vulnerability exists in the file upload restriction mechanism within app/Misc/Helper.php, which fails to block dangerous configuration files such as .htaccess and .user.ini. On Apache servers configured with AllowOverride All—a common setting in many hosting environments—an authenticated attacker can upload a malicious .htaccess file to redefine how the server processes files, ultimately enabling Remote Code Execution (RCE).

Critical Impact

Authenticated attackers can achieve Remote Code Execution on vulnerable FreeScout installations running on Apache servers, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

• FreeScout versions prior to 1.8.206
• FreeScout installations on Apache servers with AllowOverride All configuration
• FreeScout deployments using default file upload restrictions

Discovery Timeline

• 2026-02-25 - CVE-2026-27636 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27636

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue stems from an incomplete blocklist implementation in FreeScout's file upload validation logic. While the application attempts to restrict dangerous file extensions, the restriction list in app/Misc/Helper.php does not include Apache configuration files (.htaccess) or PHP configuration files (.user.ini).

When deployed on Apache web servers with AllowOverride All enabled—a configuration that allows per-directory overrides of server settings—an attacker with valid authentication credentials can upload a crafted .htaccess file. This file can then instruct Apache to treat arbitrary file extensions as PHP scripts, enabling the execution of malicious code uploaded through the same vulnerable mechanism.

This vulnerability can be exploited independently or chained with CVE-2026-27637 for enhanced attack scenarios.

Root Cause

The root cause is an incomplete file extension blocklist in the Helper.php file. The developers implemented restrictions for common dangerous extensions like .php, .phtml, and .phar, but overlooked server configuration files that can modify how the web server handles uploaded content. The .htaccess file allows directory-level Apache configuration changes, while .user.ini can modify PHP settings on a per-directory basis.

Attack Vector

The attack requires network access and valid authentication credentials to the FreeScout application. An authenticated user can exploit the file upload functionality to upload a malicious .htaccess file containing directives that enable PHP execution for non-standard file extensions. Subsequently, the attacker uploads a file with a seemingly benign extension (e.g., .txt or .jpg) containing PHP code, which Apache then executes as a PHP script based on the .htaccess directives.

The attack is feasible when:

1. The target server runs Apache with AllowOverride All
2. The attacker has authenticated access to FreeScout
3. Uploaded files are accessible via direct URL requests

// Security patch in app/Misc/Helper.php - Extend Helper::restricted_extensions list
// Source: https://github.com/freescout-help-desk/freescout/commit/9984071e6f1b4e633fdcffcea82bbebc9c1e009c

         'phar',
         //'htaccess',
         //'user.ini',
+        'shtml',
+        'cgi',
+        'asp',
+        'aspx',
+        'jsp',
+        'config',
     ];

     /**

Source: GitHub Commit Log

Detection Methods for CVE-2026-27636

Indicators of Compromise

• Presence of .htaccess files in FreeScout upload directories that were not placed by administrators
• Unexpected .user.ini files appearing in web-accessible directories
• Web server logs showing requests for unusual file types being processed as PHP
• Authentication logs showing file upload activity followed by suspicious requests to uploaded files

Detection Strategies

• Monitor file system events for creation of .htaccess or .user.ini files in upload directories
• Implement web application firewall (WAF) rules to block uploads of Apache/PHP configuration files
• Review Apache access logs for execution of files in upload directories with non-PHP extensions
• Deploy endpoint detection to identify unauthorized web shell activity or suspicious process spawning from web server processes

Monitoring Recommendations

• Enable detailed logging on file upload functionality within FreeScout
• Configure SIEM rules to alert on .htaccess file creation events in web application directories
• Monitor for POST requests to file upload endpoints followed by GET requests to the same uploaded path
• Establish baseline behavior for authenticated users and alert on anomalous upload patterns

How to Mitigate CVE-2026-27636

Immediate Actions Required

• Upgrade FreeScout to version 1.8.206 or later immediately
• Audit upload directories for any unauthorized .htaccess or .user.ini files
• Review Apache configuration and consider restricting AllowOverride directives where possible
• Implement network segmentation to limit authenticated user access from untrusted networks

Patch Information

FreeScout version 1.8.206 addresses this vulnerability by extending the Helper::restricted_extensions list to include additional dangerous file types including shtml, cgi, asp, aspx, jsp, and config files. The patch also addresses CVE-2026-27637. Organizations should apply this update through their standard FreeScout upgrade process.

For detailed patch information, refer to the GitHub Security Advisory GHSA-mw88-x7j3-74vc and the security commit.

Workarounds

• Modify Apache configuration to use AllowOverride None or more restrictive settings if application functionality permits
• Implement server-level restrictions to prevent .htaccess files from being served or processed in upload directories
• Deploy a web application firewall (WAF) with rules to block configuration file uploads
• Restrict network access to FreeScout to trusted IP ranges only

# Apache configuration to disable .htaccess in upload directories
<Directory "/path/to/freescout/storage/app/attachments">
    AllowOverride None
    <FilesMatch "\.php$">
        Deny from all
    </FilesMatch>
</Directory>