CVE-2026-27636
High
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.
SeverityHigh
CVSS8.8
Exploit probability—
ProductFreescout
PublishedFeb 25, 2026
First seenFeb 25, 2026
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- freescout freescout1.8.206 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freescout freescout | v < 1.8.206 | 1.8.206 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.