CVE-2026-28289

Think of FreeScout as your business’s shared inbox/help desk. This issue is like a lock that was supposed to stop dangerous file uploads, but someone can slip past it using an “invisible” character in the file name—then they may be able to run commands on the server. If your help desk staff accounts (or an attacker who got an account) can upload files, the risk is higher.

This matters if you run FreeScout and you’re using a version at or before 1.8.206. It’s most relevant when an attacker can get an account that has file upload permissions, because the weakness is triggered through uploading a specially named file. It is not a simple “visit a website and get hacked” situation; the attacker needs a valid path via upload permissions.

This is urgent because a public proof-of-concept exists and attackers could use it to turn file upload access into full server control. The vulnerability is not yet listed in CISA KEV, but the issue’s likelihood is rising and there is a confirmed vendor fix available. With the affected version window ending at 1.8.206, the fastest safe move is upgrading to the fixed release.