FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list

APACHE

25-02-2026 19:22

CVE-2026-27636 Vulnerabilidad documentada

Sin puntuación

Tags

#apache

#exploit

#servers

#server

#php

#list

#laravel

#config

#vulnerability

#/php(.*)8/iU

#php 8

#authenticated

#remote

#fix

#execution

#configuration

#allow

#access

Descripción

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers `AllowOverride All` (a common configuration), an authenticated user can redefine how files are processed, enabling Remote Code Execution. This vulnerability be exploited on its own combination CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.

https://github.com/freescout-help-desk/freescout/commit/9984071e6f1b4e633fdcffcea82bbebc9c1e009c

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6gcm-v8xf-j9v9

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-mw88-x7j3-74vc

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6gcm-v8xf-j9v9

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-mw88-x7j3-74vc

Referencia

CVE-2026-27637

Link externo

Ver detalles

Fuente

https://nvd.nist.gov/vuln/detail/CVE-2026-27636

Resultados similares

Coincidentes en almenos en 50% de los tags

16-03-2026 CVE-2016-20026
ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server tha...
Ver información

13-03-2026 CVE-2025-66249
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in...
Ver información