CVE-2026-28289

The vulnerability lies in the sanitizeUploadedFileName() function in the app/Http/Helper.php file. The function contains a Time-of-Check to Time-of-Use (TOCTOU) class error: checking the dot prefix in the filename (intended to detect configuration files such as .htaccess) occurs before the sanitization stage, which removes invisible characters (including zero-width space). An attacker uploads a file with a name containing a zero-width space before '.htaccess', which causes the security verification to not recognize it as a configuration file, but when saved to disk the Apache server interprets it as an .htaccess file. This enables the introduction of malicious directives and execution of code on the server side.

An attacker can gain full remote control over the server (RCE), which may lead to disclosure, modification or destruction of data and to further lateral movement in the infrastructure.

FreeScout should be updated to version 1.8.207, in which the vulnerability has been fixed. The patch is available in the vendor's repository (commit f7bc16c). Until the update is applied, it is recommended to restrict file upload permissions exclusively to trusted users.

FreeScout in version 1.8.206 and earlier — affects instances where at least one user has file upload permissions.