CVE-2026-41193 - Vulnerability Analysis

Overview

FreeScout < 1.8.215 contains a path traversal caused by improper validation of file paths during ZIP archive extraction in the module installation feature, letting authenticated admins write arbitrary files on the server filesystem.

Severity & Score

Impact

Authenticated admins can write arbitrary files on the server, potentially leading to full system compromise.

Mitigation

Upgrade to version 1.8.215 or later.

References

• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-r85m-5mc9-cc9w
• https://github.com/freescout-help-desk/freescout/commit/14f17a5cd22d217103a72b431b47b1f06996227b
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 21, 2026

🔴 CVE-2026-41193 - Critical (9.1) FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41193/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner