Incomplete upload denylist enables authenticated RCE in FreeScout (CVE-2026-53593)

FreeScout's file upload denylist (`Helper::$restricted_extensions`) does not include the `.pht` extension, leaving the authenticated upload endpoint `POST /uploads/upload` (`SecureController@upload`) able to store `.pht` files in the web-accessible directory `storage/app/public/uploads/`. On standard Apache deployments with `libapache2-mod-php`, the default PHP handler executes `.pht` files, allowing any authenticated agent to upload a web shell and run arbitrary commands as the web-server user (`www-data`). This is a direct bypass of the fix for CVE-2025-48471, which added `phtml` and `phar` to the denylist but omitted `pht`. Affected versions: - <1.8.224 We recommend updating to: 1.8.224. CVSS 8.8 · our assessment: this_week Reference: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-27vp-fpg8-j8wv Details: https://vuln.today/cve/CVE-2026-53593