FreeScout Arbitrary File Write via Crafted ZIP Upload (CVE-2026-41193)

FreeScout, a self-hosted help desk and shared mailbox platform, is susceptible to a critical vulnerability (CVE-2026-41193) affecting versions prior to 1.8.215. This flaw resides in the module installation feature, where ZIP archives are extracted without proper validation of file paths. An authenticated administrator can exploit this vulnerability by uploading a specially crafted ZIP archive, leading to arbitrary file write operations on the server filesystem. The vendor patched this vulnerability in version 1.8.215. Successful exploitation allows an attacker to achieve code execution on the targeted server, potentially leading to full system compromise.

Attack Chain

1. An attacker gains valid administrator credentials to the FreeScout platform.
2. The attacker navigates to the module installation section within the FreeScout admin panel.
3. The attacker crafts a malicious ZIP archive containing files with manipulated paths (e.g., using "../" sequences) designed to write outside the intended directory.
4. The attacker uploads the crafted ZIP archive through the module installation feature.
5. The FreeScout application extracts the contents of the ZIP archive without proper validation of the file paths.
6. The malicious files are written to arbitrary locations on the server's filesystem, as specified by the manipulated paths in the ZIP archive.
7. The attacker leverages the written files to execute arbitrary code, potentially overwriting system files or placing malicious scripts in web-accessible directories.
8. The attacker achieves persistent access and control over the FreeScout server.

Impact

Successful exploitation of CVE-2026-41193 allows a malicious actor with administrative access to write arbitrary files to the FreeScout server's filesystem. This can lead to arbitrary code execution, complete compromise of the server, data theft, and disruption of help desk services. Given the potential for full system takeover, this vulnerability poses a critical risk to organizations using affected FreeScout versions.

Recommendation

• Upgrade FreeScout to version 1.8.215 or later to patch CVE-2026-41193 (reference: Overview).
• Deploy the Sigma rule "FreeScout Suspicious ZIP Upload" to detect potentially malicious ZIP uploads to the FreeScout server (reference: rules).
• Monitor web server logs for unusual file creation events in sensitive directories after ZIP archive extractions (reference: rules, logsource).
• Implement strict access control policies to limit the number of users with administrative privileges in FreeScout.