FreeScout hat einen Zip Slip Pfad Traversing in der Modulinstallation, der eine beliebige Dateischreibung ermöglicht und zu RCE führt

The impact of this vulnerability is severe. A successful exploit allows an authenticated administrator to execute arbitrary code on the server hosting FreeScout. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. An attacker could potentially gain control of the entire server infrastructure, especially if the FreeScout instance is configured with elevated privileges or has access to sensitive data. The ability to write arbitrary files bypasses standard security controls and provides a direct path to code execution, making it a high-risk vulnerability.

Organizations using FreeScout for help desk and shared mailbox management are at risk, particularly those running vulnerable versions (1.0.0 through 1.8.214). Shared hosting environments where multiple users share the same server are especially vulnerable, as a compromised administrator account could impact all users on the server.

• php: Examine web server access logs for requests to the module installation endpoint with unusual ZIP archive filenames or paths.

grep -i 'module_install.php' /var/log/apache2/access.log | grep -i '.zip'

• php: Monitor file system activity for unexpected file creations or modifications in sensitive directories.

find /var/www/freescout -type f -mmin -60 -ls

• generic web: Check for unusual files in the FreeScout installation directory, particularly those with unexpected extensions or names. • generic web: Review FreeScout logs for errors related to ZIP archive extraction or file writing.

1. 2026-04-21Disclosure

   disclosure

1. Reserviert2026-04-18
2. Veröffentlicht2026-04-21
3. EPSS aktualisiert2026-04-29

The primary mitigation is to immediately upgrade FreeScout to version 1.8.215 or later, which addresses the path validation issue. If upgrading is not immediately feasible, consider restricting administrator access to the module installation feature. Implement a Web Application Firewall (WAF) rule to block uploads of ZIP archives with suspicious filenames or paths. Monitor FreeScout logs for unusual file creation activity, particularly in sensitive directories. After upgrading, confirm the fix by attempting to upload a test ZIP archive with a deliberately invalid path; the upload should be rejected.