CVE-2026-28289 - Vulnerability Analysis

Overview

FreeScout <= 1.8.206 contains a remote code execution caused by a TOCTOU flaw in sanitizeUploadedFileName() allowing authenticated users with file upload permissions to bypass checks via zero-width space prefixed .htaccess files.

Severity & Score

Impact

Authenticated users with file upload permissions can execute arbitrary code remotely, leading to full server compromise.

Mitigation

Upgrade to version 1.8.207 or later.

References

• https://github.com/freescout-help-desk/freescout/commit/f7bc16c56a6b13c06da52ad51fd666546b40818f
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5gpc-65p8-ffwp

Social Media Activity(1 post)

Metasploit

@metasploit

Apr 3, 2026

Metasploit Framework is here with 5 new modules! Exploits for FreeScout (CVE-2026-28289) and Grav CMS (CVE-2025-50286) RCEs, plus a generic HTTP command execution module and a new Windows persistence technique. We also have a slew of bug fixes and enhancements including SOCKS proxy performance improvements #Metasploit https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-04-03-2026/1

View original post

GitHub Repositories(1 repo)

• https://github.com/0xBlackash/CVE-2026-28289

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner