Exploitation Summary
EIP tracks 5 public exploits for CVE-2026-28289.
PoCs published by XiaomingX, exploitintel, 0xBlackash, including Metasploit module exploits/multi/http/freescout_htaccess_rce.
AI-analyzed exploit summary The repository contains a functional Python script that exploits CVE-2026-28289, a zero-click RCE vulnerability in FreeScout. The exploit sends a crafted email with malicious attachments (a Unicode-prefixed .htaccess and a PHP webshell) to bypass filename sanitization and achieve remote code execution.
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
Exploits (5)
The repository contains a functional Python script that exploits CVE-2026-28289, a zero-click RCE vulnerability in FreeScout. The exploit sends a crafted email with malicious attachments (a Unicode-prefixed .htaccess and a PHP webshell) to bypass filename sanitization and achieve remote code execution.
This repository contains functional exploit code for CVE-2026-28289, a TOCTOU vulnerability in FreeScout ≤1.8.206 that allows authenticated RCE via .htaccess upload bypass using Unicode manipulation. The PoC includes multiple attack vectors and a Docker-based lab environment for testing.
The repository contains a functional Python script that exploits CVE-2026-28289, a zero-click RCE vulnerability in FreeScout. The exploit sends a malicious email with a Unicode-prefixed .htaccess file and a PHP webshell, bypassing filename sanitization to achieve remote code execution.
The repository contains a functional Python script that exploits CVE-2026-28289, a zero-click RCE vulnerability in FreeScout. The exploit sends a malicious email with a Unicode-prefixed .htaccess file and a PHP webshell, bypassing filename sanitization to achieve remote code execution.
This Metasploit module exploits CVE-2026-28289 in FreeScout <= 1.8.206 by sending a crafted email with a ZWSP-prefixed .htaccess attachment, which bypasses filename sanitization and achieves RCE via PHP code execution.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H