CVE-2026-28289: FreeScout RCE Vulnerability via Bypass

CVE-2026-28289 Overview

CVE-2026-28289 is a Remote Code Execution (RCE) vulnerability affecting FreeScout, a free help desk and shared inbox application built with PHP's Laravel framework. This vulnerability represents a patch bypass for the previously disclosed CVE-2026-27636, allowing any authenticated user with file upload permissions to execute arbitrary code on the server by uploading a malicious .htaccess file.

The attack leverages a zero-width space character prefix to circumvent security checks in the sanitizeUploadedFileName() function, exploiting a Time-of-Check to Time-of-Use (TOCTOU) race condition where dot-prefix validation occurs before invisible character sanitization.

Critical Impact

Authenticated attackers with file upload permissions can achieve full Remote Code Execution on the FreeScout server, potentially compromising all help desk data, customer information, and gaining a foothold for lateral movement within the network infrastructure.

Affected Products

• FreeScout versions 1.8.206 and earlier
• FreeScout Help Desk installations with file upload functionality enabled
• Self-hosted FreeScout instances running on Apache web servers

Discovery Timeline

• 2026-03-03 - CVE-2026-28289 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28289

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) combined with a TOCTOU race condition. The flaw exists in the file upload sanitization logic within app/Http/Helper.php, specifically in the sanitizeUploadedFileName() function.

When processing uploaded files, the function checks if a filename begins with a dot character to prevent hidden files like .htaccess from being uploaded. However, this security check is performed before the function sanitizes and removes invisible Unicode characters from the filename. An attacker can prepend a zero-width space (Unicode U+200B) or similar invisible character to the filename, causing the dot-prefix check to pass while the subsequent sanitization removes the invisible character—leaving a valid .htaccess file on the server.

Root Cause

The root cause is an ordering flaw in the input validation sequence within the sanitizeUploadedFileName() function. The security validation (dot-prefix check) occurs at a different point in time than the sanitization process that removes invisible characters, creating a classic TOCTOU vulnerability. The filename \\u200B.htaccess passes the initial check since it doesn't technically start with a dot, but after sanitization, it becomes .htaccess, which Apache interprets as a configuration file capable of enabling PHP code execution.

Attack Vector

The attack requires network access and authentication with file upload permissions on the FreeScout application. An attacker crafts a malicious .htaccess file that enables PHP code execution within the upload directory and prepends a zero-width space character to the filename before uploading.

The malicious .htaccess file typically contains Apache directives that treat uploaded files with certain extensions as executable PHP scripts, or enables directory listing and script execution. Once uploaded, the attacker can then upload a PHP webshell or execute arbitrary server-side code through the compromised configuration.

For detailed technical analysis, see the Ox Security CVE Analysis and the GitHub Security Advisory GHSA-5gpc-65p8-ffwp.

Detection Methods for CVE-2026-28289

Indicators of Compromise

• Presence of .htaccess files in FreeScout upload directories that were not placed by administrators
• Upload directory containing unexpected PHP files or webshells
• Web server logs showing POST requests to file upload endpoints with unusual Unicode characters in filenames
• Unauthorized file access or execution patterns in the FreeScout attachment storage paths

Detection Strategies

• Monitor file system events for creation of .htaccess files in FreeScout upload directories using file integrity monitoring (FIM) tools
• Implement web application firewall (WAF) rules to detect and block upload requests containing zero-width space characters (U+200B, U+FEFF, U+200C, U+200D) in filenames
• Analyze web server access logs for unusual file upload patterns, particularly files with non-printable characters
• Deploy endpoint detection rules that alert on Apache/Nginx configuration file creation outside of expected administrative workflows

Monitoring Recommendations

• Enable detailed logging of all file upload operations in FreeScout, including raw filename data before sanitization
• Configure SIEM alerts for any .htaccess file modifications or creations in web application directories
• Implement behavioral analysis to detect post-exploitation activities such as new PHP file execution from upload directories
• Monitor for lateral movement attempts originating from the web server following potential compromise

How to Mitigate CVE-2026-28289

Immediate Actions Required

• Upgrade FreeScout to version 1.8.207 or later immediately to apply the security patch
• Audit existing upload directories for any suspicious .htaccess files or unexpected PHP scripts
• Review file upload permissions and restrict them to only essential users until the patch is applied
• Temporarily disable file upload functionality if immediate patching is not possible

Patch Information

FreeScout has released version 1.8.207 which addresses this vulnerability. The fix modifies the sanitizeUploadedFileName() function to perform character sanitization before the dot-prefix security check, eliminating the TOCTOU condition.

The patch is available in the GitHub commit f7bc16c56a6b13c06da52ad51fd666546b40818f. Organizations should update through their standard FreeScout update process or apply the patch manually if using a custom deployment.

Workarounds

• Implement server-level restrictions that prevent .htaccess files from being processed in upload directories by adding AllowOverride None to the Apache configuration for those paths
• Deploy a web application firewall rule to strip or block zero-width Unicode characters from uploaded filenames
• Restrict file upload permissions to only trusted administrative users until the patch can be applied
• Configure Apache to use php_admin_flag engine off in upload directories to prevent PHP execution regardless of .htaccess contents

# Apache configuration to disable .htaccess processing in upload directories
<Directory "/path/to/freescout/storage/app/attachments">
    AllowOverride None
    php_admin_flag engine off
    Options -ExecCGI -Indexes
</Directory>