Exploit for CVE-2026-53595

CVE-2026-53595 + CVE-2026-53593 — FreeScout Anonymous ATO →...

CVE-2026-53593 FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads Helper::$restrictedextensions is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/uplo...