Patch, then patch again: how CVE-2026-28289 turned FreeScout's fix into zero-click RCE

On February 25, 2026, FreeScout shipped version 1.8.206 to close an authenticated remote-code-execution bug, CVE-2026-27636. Six days later, researchers at OX Security showed the fix was bypassable — and escalated the same root flaw to a zero-click, unauthenticated RCE now tracked as CVE-2026-28289. It is a clean, small, almost textbook example of why a patch is a milestone, not a finish line.

What FreeScout is, and why a helpdesk bug travels

FreeScout is a self-hosted help desk and shared mailbox built on PHP's Laravel framework — a popular subscription-free alternative to Help Scout. Per OX Research's March 2026 writeup, Shodan surfaced roughly 1,100 internet-exposed instances across public-health institutions, technology providers, financial services, and news organizations. A helpdesk sits on top of sensitive support tickets and inbound mail, which is exactly why an RCE here lands hard.

The first fix: CVE-2026-27636

CVE-2026-27636 (CVSS 8.8) let an authenticated user with upload permission write a .htaccess or .user.ini file on Apache servers configured with AllowOverride All — a common default — and use it to redefine how files in that directory execute, reaching RCE. The 1.8.206 fix appended an underscore to any uploaded filename that used a restricted extension or began with a dot, so .htaccess became _htaccess. Reasonable. Not enough.

The bypass: one zero-width space

OX found that prepending a zero-width space (Unicode U+200B) to the filename slips it past the dot-prefix check, because the invisible character is not the literal . the check looks for. The check runs before sanitizeUploadedFileName() strips invisible characters — a textbook time-of-check / time-of-use (TOCTOU) ordering bug. After sanitization the U+200B is removed, and the file lands on disk as a true .htaccess — exactly what the check was meant to block.

From authenticated to zero-click (Mail2Shell)

OX then went further. A crafted email sent to any mailbox FreeScout is configured to receive needs no authentication and no user interaction; its attachment is written to a predictable path under /storage/attachment/, which is web-accessible. That turns the authenticated upload chain into a zero-click unauthenticated RCE — the path the CVE-2026-28289 CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) actually scores. OX calls the technique Mail2Shell.

Original vs bypass

What the CVSS 10 actually measures (and what it doesn't)

Disclosure timeline

What to do right now

1. Upgrade FreeScout to 1.8.207 or later. Version 1.8.206 is not sufficient — the dot-prefix check it added is bypassable.
2. On Apache, set AllowOverride None for the FreeScout document root, even on 1.8.207. This is standing hardening, not just a workaround.
3. Hunt for indicators of prior exploitation: search storage/attachment for rogue .htaccess or .user.ini files.
4. Rotate the Laravel APP_KEY if you ever ran an affected version with internet exposure — CVE-2026-27637 made a leaked key sufficient for admin takeover.
5. Subscribe this product to version-triggered CVE alerts so the next bypass reaches you before it reaches attackers.

$ find /var/www/freescout/storage/attachment \$   \( -name '.htaccess' -o -name '.user.ini' \) -type f -print$ # Anything printed here is suspicious — uploaded dotfiles should not exist$ # in attachment storage. Review and remove, then check access logs.

# /etc/apache2/sites-available/freescout.conf — defence in depth
<Directory /var/www/freescout/public>
    AllowOverride None
    Require all granted
</Directory>
# Apply: a2ensite freescout && systemctl reload apache2

Data as of 2026-07-18live record →