CVE-2026-27636
HIGHFreeScout < 1.8.206 - Authenticated Remote Code Execution via .htaccess Upload
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-27636.
PoCs published by XiaomingX, rav1010, offensiveee, Nir Zadok (nirzadokox) <OX Security>, Moses Bhardwaj (MosesOX) <OX Security>, including Metasploit module exploits/multi/http/freescout_htaccess_rce.
AI-analyzed exploit summary The repository contains a Python script designed for passive reconnaissance and fingerprinting of FreeScout deployments, focusing on detecting exposure related to CVE-2026-27636. It performs various checks such as favicon hashing, directory listing detection, module enumeration, and security header analysis without attempting exploitation.
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.
Exploits (3)
The repository contains a Python script designed for passive reconnaissance and fingerprinting of FreeScout deployments, focusing on detecting exposure related to CVE-2026-27636. It performs various checks such as favicon hashing, directory listing detection, module enumeration, and security header analysis without attempting exploitation.
The repository contains a Python script designed for passive reconnaissance and fingerprinting of FreeScout deployments, focusing on detecting exposure related to CVE-2026-27636. It performs various checks such as favicon hashing, directory listing detection, module enumeration, and security header analysis without attempting exploitation.
This Metasploit module exploits an unauthenticated RCE in FreeScout via a ZWSP bypass in .htaccess uploads. It sends a crafted email with a malicious .htaccess attachment, which is processed by FreeScout's cron job and executed as PHP.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H