FreeScout - CraftedSignal Threat Feed

FreeScout Arbitrary File Write via Crafted ZIP Upload (CVE-2026-41193)

hello@craftedsignal.io — Fri, 26 Jan 2024 12:00:00 +0000

FreeScout, a self-hosted help desk and shared mailbox platform, is susceptible to a critical vulnerability (CVE-2026-41193) affecting versions prior to 1.8.215. This flaw resides in the module installation feature, where ZIP archives are extracted without proper validation of file paths. An authenticated administrator can exploit this vulnerability by uploading a specially crafted ZIP archive, leading to arbitrary file write operations on the server filesystem. The vendor patched this vulnerability in version 1.8.215. Successful exploitation allows an attacker to achieve code execution on the targeted server, potentially leading to full system compromise.

Attack Chain

An attacker gains valid administrator credentials to the FreeScout platform.
The attacker navigates to the module installation section within the FreeScout admin panel.
The attacker crafts a malicious ZIP archive containing files with manipulated paths (e.g., using "../" sequences) designed to write outside the intended directory.
The attacker uploads the crafted ZIP archive through the module installation feature.
The FreeScout application extracts the contents of the ZIP archive without proper validation of the file paths.
The malicious files are written to arbitrary locations on the server's filesystem, as specified by the manipulated paths in the ZIP archive.
The attacker leverages the written files to execute arbitrary code, potentially overwriting system files or placing malicious scripts in web-accessible directories.
The attacker achieves persistent access and control over the FreeScout server.

Impact

Successful exploitation of CVE-2026-41193 allows a malicious actor with administrative access to write arbitrary files to the FreeScout server's filesystem. This can lead to arbitrary code execution, complete compromise of the server, data theft, and disruption of help desk services. Given the potential for full system takeover, this vulnerability poses a critical risk to organizations using affected FreeScout versions.

Recommendation

Upgrade FreeScout to version 1.8.215 or later to patch CVE-2026-41193 (reference: Overview).
Deploy the Sigma rule "FreeScout Suspicious ZIP Upload" to detect potentially malicious ZIP uploads to the FreeScout server (reference: rules).
Monitor web server logs for unusual file creation events in sensitive directories after ZIP archive extractions (reference: rules, logsource).
Implement strict access control policies to limit the number of users with administrative privileges in FreeScout.

FreeScout Unauthorized Attachment Deletion Vulnerability (CVE-2026-41192)

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

FreeScout, a self-hosted help desk and shared mailbox platform, is susceptible to an unauthorized attachment deletion vulnerability in versions prior to 1.8.215. This flaw stems from the application's trust in client-supplied encrypted attachment IDs during reply and draft processes. An attacker with access to a mailbox conversation can exploit this by obtaining encrypted attachment IDs and replaying them through the save_draft functionality. The lack of proper validation allows the attacker to trigger the Attachment::deleteByIds() function, leading to the deletion of the original attachment row and file. This vulnerability was addressed in FreeScout version 1.8.215. Exploitation can result in data loss and disruption of service for affected FreeScout users.

Attack Chain

Attacker gains access to a FreeScout mailbox with visible conversations containing attachments.
Attacker inspects the HTML source or API responses of a conversation to obtain encrypted attachment IDs. These IDs are associated with legitimate attachments within the conversation.
The attacker crafts a malicious save_draft request, including the replayed encrypted attachment IDs in the attachments_all[] parameter.
The attacker omits these replayed IDs from any retained attachment lists within the save_draft request.
FreeScout processes the save_draft request and decrypts the attachment IDs present in attachments_all[] but absent from the retained lists.
The decrypted IDs are passed to the Attachment::deleteByIds() function without proper validation.
Attachment::deleteByIds() executes, deleting the original attachment row and the corresponding file from the FreeScout server.
The victim user finds that the attachment has been deleted from the conversation.

Impact

Successful exploitation of this vulnerability (CVE-2026-41192) allows an attacker to delete attachments from FreeScout conversations without proper authorization. The number of potential victims depends on the number of FreeScout installations and the number of users with access to shared mailboxes. This can lead to data loss, disruption of business processes that rely on those attachments, and a potential loss of trust in the help desk system. The CVSS v3.1 base score for this vulnerability is 7.1, indicating a high severity.

Recommendation

Upgrade FreeScout installations to version 1.8.215 or later to patch CVE-2026-41192.
Implement web application firewall (WAF) rules to monitor and block suspicious save_draft requests containing potentially replayed attachment IDs (cs-uri-query, cs-method from webserver logs).
Monitor FreeScout application logs for calls to Attachment::deleteByIds() originating from unusual IP addresses or user agents (application logs).
Deploy the provided Sigma rule to detect suspicious patterns in web server logs indicative of exploitation attempts.

FreeScout Stored XSS Vulnerability in Mailbox Signatures (CVE-2026-40568)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

FreeScout, a self-hosted help desk and shared mailbox platform, is vulnerable to a stored XSS attack in versions prior to 1.8.213. The vulnerability resides in the mailbox signature feature, where the sanitization function Helper::stripDangerousTags() at app/Misc/Helper.php:568 inadequately filters HTML tags and attributes. Specifically, it fails to remove event handler attributes and only blocks script, form, iframe, and object tags. An authenticated user possessing the ACCESS_PERM_SIGNATURE (sig) permission can inject malicious HTML, including tags like , , and

with event handlers such as onerror or onload. This injected code is then executed whenever any agent or administrator opens a conversation in the affected mailbox. Successful exploitation can lead to session hijacking, phishing attacks, and email exfiltration. The vulnerability was patched in version 1.8.213.

Attack Chain

An attacker authenticates to FreeScout with an account possessing the ACCESS_PERM_SIGNATURE permission.
The attacker navigates to the mailbox settings.
The attacker injects malicious HTML containing XSS payloads into the mailbox signature field. Example: .
The attacker saves the modified mailbox signature via MailboxesController::updateSave() at app/Http/Controllers/MailboxesController.php:267. The incomplete sanitization allows the malicious HTML to be stored in the database.
The signature is rendered as raw HTML via the Blade {!! !!} tag in editor_bottom_toolbar.blade.php:6.
The raw HTML is re-inserted into the DOM by jQuery .html() at main.js:1789-1790.
The injected event handler (e.g., onerror) is triggered when the HTML is rendered in a conversation view.
The attacker executes arbitrary JavaScript code within the context of the FreeScout application, potentially leading to session hijacking, phishing overlays, or further malicious actions like email exfiltration.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the FreeScout application. This can lead to a range of malicious activities, including session hijacking, phishing attacks against agents and administrators, and even email exfiltration. Since the vulnerability requires only the ACCESS_PERM_SIGNATURE permission, which can be delegated, the attack surface is broad. The CVSS v3.1 base score is 8.5, indicating a high severity.

Recommendation

Upgrade FreeScout to version 1.8.213 or later to patch CVE-2026-40568.
Implement the "Detect FreeScout XSS Attempt via Mailbox Signature" Sigma rule to identify attempts to inject malicious HTML in mailbox signatures.
Review and restrict the ACCESS_PERM_SIGNATURE permission to only trusted users to minimize the attack surface.
Monitor web server logs for requests to MailboxesController::updateSave() (app/Http/Controllers/MailboxesController.php:267) containing potentially malicious HTML payloads.