CVE-2026-53593 in FreeScout
Summary
by MITRE • 07/20/2026
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (`Helper::$restricted_extensions`) is incomplete: it does not cover the `.pht` extension. The authenticated upload endpoint `POST /uploads/upload` (`SecureController@upload`) stores files with their original extension into the web-accessible directory `storage/app/public/uploads/` (served at `/storage/uploads/`). On the standard Apache + `libapache2-mod-php` deployment, the default handler `<FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$">` executes `.pht`, so **any authenticated agent can upload a `.pht` web shell and run arbitrary commands as the web-server user** (`www-data`). This is a direct bypass of the fix for CVE-2025-48471, which added `phtml`/`phar` but not `pht` (nor `phtm`, `phps`). Version 1.8.224 contains an updated fix.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in FreeScout affects versions prior to 1.8.224 and represents a critical security flaw in the file upload validation mechanism within the application's Laravel framework. This issue stems from an incomplete denylist implementation that fails to properly restrict dangerous file extensions, specifically overlooking the `.pht` extension which is commonly used for web shell exploitation. The vulnerability exists within the authenticated upload endpoint POST /uploads/upload which processes file uploads through the SecureController@upload method, storing files in the web-accessible directory storage/app/public/uploads/ that is served at /storage/uploads/. This represents a classic path traversal and privilege escalation vector that directly violates secure coding principles and security by design.
The technical exploitation of this vulnerability relies on the combination of incomplete input validation and the default Apache configuration with libapache2-mod-php module. The Apache server's default handler `<FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$">` executes files with extensions matching the regular expression pattern including `.pht`, which allows uploaded malicious files to be interpreted as PHP code rather than being treated as static content. This misconfiguration creates an execution environment where any authenticated user can upload a `.pht` file and subsequently execute arbitrary commands with the privileges of the web server process (typically www-data). The vulnerability represents a direct bypass of CVE-2025-48471 which had previously addressed similar issues but failed to include the `pht` extension in its mitigation, along with other related extensions like `phtm` and `phps`.
The operational impact of this vulnerability is severe and directly affects the confidentiality, integrity, and availability of the FreeScout application and underlying infrastructure. An authenticated attacker can establish persistent command execution capabilities, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network. The vulnerability affects the core security controls that should prevent malicious file uploads, creating a critical attack surface that allows for privilege escalation from authenticated user access to full system control. This flaw violates multiple security standards including CWE-434 which addresses insecure file upload handling and CWE-20 which covers input validation issues, while also aligning with ATT&CK technique T1505.003 for web shell deployment and T1059.007 for command and scripting interpreter execution.
The remediation for this vulnerability requires immediate patching to version 1.8.224 or later which implements a comprehensive updated denylist that properly excludes all dangerous file extensions including `.pht`, `.phtm`, and `phps`. Additionally, organizations should implement multiple layers of defense including web application firewall rules that block uploads with suspicious extensions, regular security scanning of uploaded content, and monitoring for unusual file upload patterns. Network-level mitigations such as implementing Content Delivery Network (CDN) rules to prevent direct access to upload directories and ensuring proper Apache configuration with restricted execution permissions can provide additional protection. The incident highlights the importance of comprehensive testing of security controls and demonstrates how a single oversight in input validation can create a critical exploit path that bypasses multiple security mechanisms. Organizations should also conduct thorough vulnerability assessments to ensure no other similar oversights exist in their file upload handling mechanisms, particularly when dealing with PHP-based applications that rely on server-side execution environments.