Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.

Severity: All Critical High

Library: freescout

CVE-2026-53593 HIGH CVSS 8.8 Verified Advisory Jul 20, 2026

Incomplete upload denylist enables authenticated RCE in FreeScout (CVE-2026-53593)

FreeScout's file upload denylist (`Helper::$restricted_extensions`) does not include the `.pht` extension, leaving the authenticated upload endpoint `POST /uploads/upload` (`SecureController@upload`) able to store `.p...

Fixed in 1.8.224

Apache File Upload Freescout

CVE-2026-53591 HIGH CVSS 8.6 Verified Advisory Jul 20, 2026

Unauthenticated conversation thread injection in FreeScout (CVE-2026-53591)

FreeScout's email ingestion command skips HMAC verification on the `In-Reply-To` header when the hash component is any length other than 16 characters, due to a backward-compatibility branch in `FetchEmails.php`. An u...

Fixed in 1.8.223

Authentication Bypass Freescout

CVE-2026-48812 HIGH CVSS 7.5 Verified Advisory Jul 20, 2026

Unauthenticated access to legacy attachments in FreeScout (CVE-2026-48812)

FreeScout's attachment download route contains a logical flaw in its token validation check that unconditionally grants access to any attachment whose `token_type` is set to `TOKEN_TYPE_LEGACY` (value `1`), bypassing ...

Fixed in 1.8.221

Authentication Bypass Freescout