CVE-2026-53593
Received Received - Intake

Authenticated File Upload Bypass via .pht Extension in FreeScout

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (`Helper::$restricted_extensions`) is incomplete: it does not cover the `.pht` extension. The authenticated upload endpoint `POST /uploads/upload` (`SecureController@upload`) stores files with their original extension into the web-accessible directory `storage/app/public/uploads/` (served at `/storage/uploads/`). On the standard Apache + `libapache2-mod-php` deployment, the default handler `<FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$">` executes `.pht`, so **any authenticated agent can upload a `.pht` web shell and run arbitrary commands as the web-server user** (`www-data`). This is a direct bypass of the fix for CVE-2025-48471, which added `phtml`/`phar` but not `pht` (nor `phtm`, `phps`). Version 1.8.224 contains an updated fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-53593
EUVD
EUVD-2026-46083

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freescout freescout to 1.8.224 (exc)
freescout freescout 1.8.224

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a high-severity authenticated remote code execution vulnerability in FreeScout, a help desk software. The issue stems from an incomplete denylist of dangerous file upload extensions, specifically missing the .pht extension. Authenticated attackers can bypass security measures and upload malicious .pht files, which are executable by default in Apache with libapache2-mod-php due to its handler configuration.

Detection Guidance

Check for unauthorized .pht files in the web-accessible uploads directory (e.g., /storage/app/public/uploads/). Use commands like 'find /path/to/uploads -name "*.pht"' to locate suspicious files. Monitor Apache access logs for requests to .pht files in the uploads directory.

Impact Analysis

An attacker can upload a .pht file disguised as harmless content, store it in a web-accessible directory, and execute arbitrary commands on the server as the web-server user (e.g., www-data). This leads to full system compromise, including access to sensitive data like .env secrets, customer PII, and database credentials.

Compliance Impact

This vulnerability allows authenticated attackers to upload and execute malicious .pht files, potentially leading to unauthorized access to sensitive data such as customer PII, database credentials, and configuration secrets. For GDPR, this could result in unauthorized data access or disclosure, violating principles of data protection and user privacy. Under HIPAA, exposure of protected health information (PHI) through such breaches would violate security requirements for safeguarding electronic PHI.

Mitigation Strategies

Upgrade FreeScout to version 1.8.224 or later. Add .pht, .phtm, and .phps to the denylist in Helper::$restricted_extensions. Disable PHP execution in the uploads directory by modifying .htaccess to include 'php_flag engine off' or equivalent server configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53593. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart