FreeScout CVE-2026-41193

Requires authenticated administrator access to FreeScout's module installation feature (PR:H in CVSS vector). The attacker must possess valid admin credentials or an active admin session. Default FreeScout installations include module management in the admin interface, so no non-default configuration is required for the vulnerable code path to be accessible. Exploitation is network-based (AV:N) with low complexity (AC:L), meaning no special timing, race conditions, or environmental factors are needed beyond admin authentication. Limiting factors: admin-only functionality reduces the pool of potential attackers to privileged insiders, compromised admin accounts, or attackers who have already achieved initial access through separate vulnerabilities. Organizations with single-admin deployments and strong MFA enforcement face substantially lower practical risk than those with multiple admin users or weak credential controls.

Real-world risk assessment reveals a critical vulnerability with important access constraints. The CVSS 9.1 score reflects genuine severity due to changed scope and full CIA triad impact, but exploitation requires authenticated administrator access (PR:H), significantly reducing the attack surface compared to unauthenticated RCE. The network attack vector (AV:N) and low complexity (AC:L) mean that once admin credentials are obtained (through phishing, credential stuffing, or insider threat), exploitation is straightforward. No EPSS score provided, preventing quantitative exploitation probability assessment. Not present in CISA KEV, indicating no confirmed widespread exploitation campaigns as of analysis date. The GitHub security advisory and commit reference provide sufficient technical detail for proof-of-concept development, increasing medium-term exploitation risk. Priority assessment: CRITICAL for internet-facing FreeScout instances with multiple admin users or weak admin credential controls; HIGH for internal deployments with strong admin access governance. The changed scope metric is particularly concerning for shared hosting or containerized deployments where lateral movement to other tenants/containers becomes possible. Organizations should prioritize patching if admin account compromise is a credible threat in their environment.

An attacker who has compromised an administrator account (via credential theft, social engineering, or session hijacking) logs into the FreeScout admin panel and navigates to the module installation feature. They craft a malicious ZIP file containing entries with path traversal sequences such as '../../../../var/www/html/malicious.php' pointing to a web-accessible directory. Upon uploading and initiating module installation, FreeScout extracts the ZIP without path validation, writing the attacker's PHP webshell to the specified location. The attacker then directly requests the webshell URL to achieve remote code execution as the web server user, enabling data exfiltration, privilege escalation, or lateral movement to the hosting infrastructure. No public POC identified at time of analysis, though the fix commit provides sufficient implementation detail for exploit reproduction.