What is the CVSS score of CVE-2026-27636?

CVE-2026-27636 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-27636?

FreeScout help desk systems prior to version 1.8.206 contain a critical file upload vulnerability that allows authenticated users to execute arbitrary code on affected servers.. A patch is available.

Is there a public PoC exploit available for CVE-2026-27636?

Yes, a public proof-of-concept exploit is available for CVE-2026-27636. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-27636?

Within 24 hours: Identify all FreeScout instances and their current versions; assess whether affected versions are deployed in production. Within 7 days: Apply vendor patch to version 1.8.206 or later on all FreeScout installations; if patching is not immediately feasible, implement the compensating control below. Within 30 days: Conduct post-patch validation; review user access logs for suspicious file uploads; audit user account privileges to reduce exposure surface.

PHP CVE-2026-27636

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-02-25 security-advisories@github.com

Apache PHP Laravel RCE Freescout

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 16:07 vuln.today

Public exploit code

Patch released

Feb 26, 2026 - 16:07 nvd

Patch available

CVE Published

Feb 25, 2026 - 04:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in app/Misc/Helper.php does not include .htaccess or .user.ini files. On Apache servers with AllowOverride All (a common configuration), an authenticated user can upload a .htaccess file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.

AnalysisAI

Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload .htaccess files that bypass file upload restrictions, enabling arbitrary code execution on Apache servers with AllowOverride All enabled. Public exploit code exists for this vulnerability. The attack requires valid user credentials but affects all FreeScout installations using the vulnerable PHP Laravel framework configuration.

Technical ContextAI

This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects Freescout. FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in app/Misc/Helper.php does not include .htaccess or .user.ini files. On Apache servers with AllowOverride All (a common configuration), an authenticated user can upload a .htaccess file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637

RemediationAI

A vendor patch is available — apply it immediately. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.