FreeScout up to 1.8.223 Helper /uploads/upload SecureController@upload restricted_extensions unrestricted upload

Summaryinfo

A vulnerability classified as critical has been found in FreeScout up to 1.8.223. Affected by this vulnerability is the function SecureController@upload of the file /uploads/upload of the component Helper. This manipulation of the argument restricted_extensions causes unrestricted upload. This vulnerability appears as CVE-2026-53593. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in FreeScout up to 1.8.223. It has been declared as critical. Affected by this vulnerability is the function SecureController@upload of the file /uploads/upload of the component Helper. The manipulation of the argument restricted_extensions with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (`Helper::$restricted_extensions`) is incomplete: it does not cover the `.pht` extension. The authenticated upload endpoint `POST /uploads/upload` (`SecureController@upload`) stores files with their original extension into the web-accessible directory `storage/app/public/uploads/` (served at `/storage/uploads/`). On the standard Apache + `libapache2-mod-php` deployment, the default handler `<FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$">` executes `.pht`, so **any authenticated agent can upload a `.pht` web shell and run arbitrary commands as the web-server user** (`www-data`). This is a direct bypass of the fix for CVE-2025-48471, which added `phtml`/`phar` but not `pht` (nor `phtm`, `phps`). Version 1.8.224 contains an updated fix.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-53593 since 06/09/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

Upgrading to version 1.8.224 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• FreeScout

Version

• 1.8.223

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion