Paper/Archive/CVE-2026-41193

CVE-2026-41193

freescout-help-desk freescout — FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE

EPSS 0.4%public exploit CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 33.4.334 × 206.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP. Version 1.8.215 fixes the vulnerability.

Affected

ProductAffectedFixed inSource

freescout< 1.8.215–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/freescout-help-desk/freescout/security/advisories/GHSA-r85m-5mc9-cc9w refgithub.com/freescout-help-desk/freescout/commit/14f17a5cd22d217103a72b431b47b1f06996227b refgithub.com/freescout-help-desk/freescout/releases/tag/1.8.215