CVE-2026-28289

🗓️ 03 Mar 2026 22:59:08Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 41 Views🌐 WEB

Authenticated user with file upload can bypass patch using a zero-width space to upload .htaccess and trigger RCE in FreeScout 1.8.206.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-28289	3 Mar 202622:59	–	attackerkb
Circl	CVE-2026-28289	4 Mar 202600:48	–	circl
CNNVD	FreeScout 代码问题漏洞	3 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution	3 Mar 202622:59	–	cvelist
EUVD	EUVD-2026-9347	3 Mar 202622:59	–	euvd
Kitploit	CVE-2026-28289	10 Sep 202620:46	–	kitploit
Kitploit	CVE-2026-27636	10 Sep 202601:35	–	kitploit
Metasploit	FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass	1 Mar 202600:00	–	metasploit
NVD	CVE-2026-28289	3 Mar 202623:15	–	nvd
Packet Storm	📄 FreeScout 1.8.206 Remote Code Execution	31 Mar 202600:00	–	packetstorm

NVD

Vulners

Node

freescout freescoutRange<1.8.207

[
  {
    "vendor": "freescout-help-desk",
    "product": "freescout",
    "versions": [
      {
        "version": "< 1.8.207",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/freescout-help-desk/freescout/security/advisories/GHSA-5gpc-65p8-ffwp
github	www.github.com/freescout-help-desk/freescout/commit/f7bc16c56a6b13c06da52ad51fd666546b40818f
ox	www.ox.security/blog/freescout-rce-cve-2026-28289/

Parameter	Position	Path	Description	CWE
filename (with leading ZWSP U+200B) and dot-prefixed .htaccess upload via email attachment	path	storage/attachment/<d1>/<d2>/<counter>/.htaccess	TOCTOU bypass allows uploading a dot-prefixed .htaccess via email attachment to enable PHP execution via SetHandler.	CWE-434

17 Jun 2026 10:28Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.1 - 10

EPSS0.3112

SSVC

CWE-434