CVE-2026-28289

CVE-2026-28289 is a high-severity patch bypass vulnerability affecting FreeScout versions 1.8.206 and earlier, a PHP-based help desk application. It allows an authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server. Rated 8.1 HIGH on the CVSS scale, the vulnerability exploits a Time-of-Check to Time-of-Use (TOCTOU) flaw in the file upload sanitization, enabling the upload of a malicious .htaccess file via a zero-width space character prefix to bypass security checks. While not on CISA's KEV list, this CVE is marked as "Active" on hotlists and has publicly available exploit code, including a Metasploit module, indicating a significant and imminent threat.