What is the CVSS score of CVE-2026-41193?

CVE-2026-41193 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeScout are affected by CVE-2026-41193?

FreeScout versions prior to 1.8.215 contain a critical arbitrary file write vulnerability that allows authenticated administrators to execute remote code by uploading malicious ZIP archives during…. A patch is available.

How to fix or mitigate CVE-2026-41193?

Within 24 hours: Identify all FreeScout instances and their current versions; restrict administrative access to module installation features pending patch deployment. Within 7 days: Upgrade all FreeScout installations to version 1.8.215 or later; review administrative access logs for suspicious module installation activity. Within 30 days: Conduct post-patch validation; implement principle-of-least-privilege controls limiting administrative module installation capabilities to designated personnel only.

FreeScout CVE-2026-41193

EUVD-2026-24223 CRITICAL

Path Traversal (CWE-22)

2026-04-21 GitHub_M

Path Traversal Freescout

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:10 nvd

Patch available

Re-analysis Queued

Apr 21, 2026 - 21:22 vuln.today

cvss_changed

Patch available

Apr 21, 2026 - 19:01 EUVD

Analysis Generated

Apr 21, 2026 - 18:48 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 17:45 euvd

EUVD-2026-24223

Analysis Generated

Apr 21, 2026 - 17:45 vuln.today

CVE Published

Apr 21, 2026 - 17:15 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP. Version 1.8.215 fixes the vulnerability.

AnalysisAI

Arbitrary file write in FreeScout (prior to 1.8.215) allows authenticated administrators to achieve remote code execution by uploading malicious ZIP archives during module installation. The path traversal vulnerability (CWE-22) enables attackers to write files to any location on the server filesystem, including web-accessible directories where PHP shells can be placed. With CVSS 9.1 (Critical) and EPSS data not provided, the primary risk factor is the changed scope (S:C) indicating potential container/hosting infrastructure compromise beyond the application itself. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis, though the fix commit provides implementation details that could facilitate exploit development.

Technical ContextAI

FreeScout is an open-source PHP-based help desk and shared inbox application. The vulnerability exists in the module installation subsystem, which processes ZIP archives containing module code and assets. The application fails to sanitize or validate file paths within ZIP entries before extraction, a classic ZIP Slip vulnerability pattern (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). An attacker can craft ZIP entries with paths like '../../../var/www/html/shell.php' to escape the intended extraction directory. The affected CPE (cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:*) indicates all versions prior to 1.8.215 are vulnerable. The CVSS vector PR:H (high privileges required) confirms this requires admin-level access to the module installation feature, while S:C (changed scope) suggests the attacker can break out of the application security boundary to compromise the underlying web server or container.

RemediationAI

Upgrade immediately to FreeScout version 1.8.215 or later, available at https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215. The fix implemented in commit 14f17a5cd22d217103a72b431b47b1f06996227b adds path validation during ZIP extraction to prevent directory traversal. For environments unable to upgrade immediately, implement compensating controls: restrict module installation functionality to a single trusted administrator account with strong MFA enforcement (reduces PR:H attack surface), monitor filesystem for unexpected file writes outside application directories using file integrity monitoring (detects exploitation attempts), and deploy FreeScout behind a web application firewall configured to detect path traversal patterns in upload requests (though this may not fully prevent ZIP-based attacks). Note that disabling module installation entirely via configuration may break legitimate administrative workflows. Each mitigation has trade-offs: restricted admin access increases operational friction, FIM generates investigation overhead, and WAF rules may cause false positives on legitimate module uploads. Patching to 1.8.215 remains the definitive solution with no functional impact.