CVE-2026-53593: FreeScout RCE Vulnerability

CVE-2026-53593 Overview

FreeScout, a PHP/Laravel-based help desk and shared inbox application, contains an unrestricted file upload vulnerability [CWE-434] in versions prior to 1.8.224. The denylist in Helper::$restricted_extensions fails to include the .pht extension. Authenticated agents can upload a .pht web shell through the POST /uploads/upload endpoint handled by SecureController@upload. On standard Apache deployments using libapache2-mod-php, the default FilesMatch directive executes .pht files as PHP. This incomplete denylist bypasses the earlier fix for CVE-2025-48471, which added phtml and phar but omitted pht, phtm, and phps. Version 1.8.224 contains the corrected denylist.

Critical Impact
Any authenticated FreeScout agent can achieve remote code execution as the www-data user, leading to full application compromise, data theft, and lateral movement.

Affected Products

FreeScout versions prior to 1.8.224
Deployments using Apache with libapache2-mod-php
Installations with the default PHP handler configuration matching .pht files

Discovery Timeline

2026-07-20 - CVE-2026-53593 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-53593

Vulnerability Analysis

The flaw resides in FreeScout's file upload validation logic. The application relies on a denylist stored in Helper::$restricted_extensions to block dangerous file types. Denylist-based validation fails when the list omits variant extensions that PHP interpreters still execute.

The authenticated upload endpoint POST /uploads/upload, backed by SecureController@upload, preserves the original file extension when writing to storage/app/public/uploads/. Uploaded files become reachable at /storage/uploads/ on the web server. A file with a .pht extension bypasses the denylist entirely and lands in a directory Apache serves directly.

Root Cause

The root cause is an incomplete denylist. The prior patch for CVE-2025-48471 added phtml and phar but did not enumerate all extensions handled by PHP. The Apache mod_php default FilesMatch directive <FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$"> executes files ending in .pht, .phtml, .phar, .php3, .php4, .php5, and .php7. Denylist-based upload filtering is inherently fragile because a single missed extension re-enables code execution.

Attack Vector

An attacker with valid agent credentials authenticates to FreeScout and issues a POST /uploads/upload request containing a PHP payload named with a .pht extension. The server stores the file and returns a public URL under /storage/uploads/. Requesting that URL triggers Apache to hand the file to the PHP interpreter, executing the attacker's code as www-data. From this position, the attacker can read the FreeScout database configuration, exfiltrate customer conversations, pivot to internal networks, or install persistent backdoors.

Refer to the GitHub Security Advisory GHSA-27vp-fpg8-j8wv for technical details.

Detection Methods for CVE-2026-53593

Indicators of Compromise

Files with .pht, .phtm, .phps, .php3, .php4, .php5, or .php7 extensions present in storage/app/public/uploads/
HTTP POST requests to /uploads/upload from agent accounts uploading files with PHP-executable extensions
HTTP GET requests to /storage/uploads/*.pht returning 200 OK with dynamic content
Unexpected outbound network connections or shell processes spawned by the www-data user

Detection Strategies

Inspect the FreeScout uploads directory for any file whose extension matches the Apache PHP handler regex \.ph(ar|p[3457]?|t|tml)$.
Parse Apache access logs for POST /uploads/upload events followed by GET /storage/uploads/ requests to files with executable extensions.
Monitor the web server process tree for child processes spawned from PHP that execute shell binaries such as sh, bash, nc, curl, or wget.

Monitoring Recommendations

Enable file integrity monitoring on storage/app/public/uploads/ and alert on any write of a file with a PHP-executable extension.
Correlate authenticated user sessions with upload activity to identify agents uploading non-standard file types.
Forward Apache and PHP-FPM logs to a centralized SIEM to enable retrospective hunting for the upload-then-execute pattern.

How to Mitigate CVE-2026-53593

Immediate Actions Required

Upgrade FreeScout to version 1.8.224 or later without delay.
Audit storage/app/public/uploads/ for existing files with PHP-executable extensions and remove any that are not legitimate.
Rotate credentials for all FreeScout agent accounts, particularly any that show anomalous upload activity.
Review database configuration files and application secrets that may have been exposed to the www-data user.

Patch Information

FreeScout version 1.8.224 updates the Helper::$restricted_extensions denylist to cover pht, phtm, and phps in addition to the previously added phtml and phar. Administrators should apply this update immediately. See the GitHub Security Advisory GHSA-27vp-fpg8-j8wv for release details.

Workarounds

Configure Apache to prevent PHP execution inside the uploads directory using a <Directory> block that removes PHP handlers and sets php_flag engine off.
Restrict the upload endpoint at the web server or reverse proxy layer until the patched version can be deployed.
Serve storage/app/public/uploads/ through a separate hostname or CDN that does not have PHP interpreters configured.

bash

# Apache configuration to disable PHP execution in uploads directory
<Directory "/var/www/freescout/storage/app/public/uploads">
    php_flag engine off
    <FilesMatch "\.ph(ar|p[3457]?|t|tml|tm|ps)$">
        Require all denied
        SetHandler none
    </FilesMatch>
    Options -ExecCGI
    RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .pht .phtm .phps .phar
    RemoveType .php .phtml .php3 .php4 .php5 .php7 .pht .phtm .phps .phar
</Directory>