File Upload Vulnerability in FreeScout Help Desk Software
CVE-2026-53593

8.8HIGH

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
20 July 2026

What is CVE-2026-53593?

A vulnerability exists in FreeScout, a PHP Laravel-based help desk software, due to an incomplete denylist for dangerous file uploads. Specifically, prior to version 1.8.224, the application fails to restrict the .pht file extension, allowing authenticated users to upload malicious files that can lead to the execution of arbitrary commands on the server. This defect bypasses previous security measures implemented to prevent similar file-based attacks. Users are advised to upgrade to version 1.8.224 to mitigate this risk.

Affected Version(s)

freescout < 1.8.224

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.