CVE-2026-53593: FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (Helper::$restrictedextensions) is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/upload (SecureController@upload) stores files with their original extension into the web-accessible directory storage/app/public/uploads/ (served at /storage/uploads/). On the standard Apache + libapache2-mod-php deployment, the default handler <FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$"> executes .pht, so any authenticated agent can upload a .pht web shell and run arbitrary commands as the web-server user (www-data). This is a direct bypass of the fix for CVE-2025-48471, which added phtml/phar but not pht (nor phtm, phps). Version 1.8.224 contains an updated fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeScoutto a version that resolves this vulnerability.Fixed in 1.8.224
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53593?
CVE-2026-53593 has a severity score of 8.8, classified as high.
How do I fix CVE-2026-53593?
To fix CVE-2026-53593, upgrade FreeScout to version 1.8.224 or later where the vulnerability is patched.
What type of vulnerability is CVE-2026-53593?
CVE-2026-53593 is an authenticated remote code execution vulnerability resulting from a malicious file upload due to an incomplete denylist.
What is the risk associated with CVE-2026-53593?
CVE-2026-53593 has a high risk rating of 79, indicating a significant threat to affected systems.
Can CVE-2026-53593 be exploited remotely?
Yes, CVE-2026-53593 can be exploited remotely due to the nature of its authenticated remote code execution capability.