freescout-help-desk freescout up to 1.8.205 app/Misc/Helper.php unrestricted upload

Summaryinfo

A vulnerability described as critical has been identified in freescout-help-desk freescout up to 1.8.205. Affected by this vulnerability is an unknown functionality of the file app/Misc/Helper.php. The manipulation results in unrestricted upload. This vulnerability was named CVE-2026-27636. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in freescout-help-desk freescout up to 1.8.205. Affected is an unknown code block of the file app/Misc/Helper.php. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-27636 since 02/20/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

By approaching the search of inurl:app/Misc/Helper.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.8.206 eliminates this vulnerability. Applying the patch 9984071e6f1b4e633fdcffcea82bbebc9c1e009c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• freescout-help-desk

Name

• freescout

Version

• 1.8.205

License

• open-source

Website

• Product: https://github.com/freescout-help-desk/freescout/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion