What is the CVSS score of EUVD-2026-46083?

EUVD-2026-46083 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Freescout are affected by EUVD-2026-46083?

FreeScout help desk software versions prior to 1.8.224 allow authenticated support agents to upload malicious files that execute arbitrary server commands, exposing customer data and creating a pivot…. A patch is available.

How to fix or mitigate EUVD-2026-46083?

Within 24 hours: inventory all FreeScout deployments, confirm versions below 1.8.224, disable file upload functionality in affected systems, and audit access logs for suspicious file uploads from agent accounts. Within 7 days: implement file-type detection and alerting rules for .pht/.phtm/.phps uploads, restrict file upload permissions to a minimal trusted set of agents, and test your upgrade procedure on a non-production instance. Within 30 days: upgrade all affected FreeScout instances to version 1.8.224 or later, validate file upload restrictions post-upgrade, and perform security testing to confirm the filter now properly blocks all executable extensions.

Freescout EUVD-2026-46083

| CVE-2026-53593 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-20 GitHub_M

Apache File Upload Freescout Freescout Help Desk

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 20, 2026 - 21:17 EUVD

Analysis Generated

Jul 20, 2026 - 20:19 vuln.today

CVE Published

Jul 20, 2026 - 19:52 cve.org

HIGH 8.8

DescriptionCVE.org

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (Helper::$restricted_extensions) is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/upload (SecureController@upload) stores files with their original extension into the web-accessible directory storage/app/public/uploads/ (served at /storage/uploads/). On the standard Apache + libapache2-mod-php deployment, the default handler <FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$"> executes .pht, so any authenticated agent can upload a .pht web shell and run arbitrary commands as the web-server user (www-data). This is a direct bypass of the fix for CVE-2025-48471, which added phtml/phar but not pht (nor phtm, phps). Version 1.8.224 contains an updated fix.

Articles & Coverage 2

News 6 New Apache Vulnerabilities - 6 High Severity, No POC Available Jul 21, 2026 News 6 New Apache Vulnerabilities - 6 High Severity Jul 20, 2026

AnalysisAI

Authenticated remote code execution in FreeScout help desk prior to version 1.8.224 allows any logged-in agent to upload a malicious .pht file that executes as PHP on the default Apache plus libapache2-mod-php stack, yielding arbitrary command execution as the www-data user. The flaw is a denylist bypass: the restricted-extension filter added by the earlier CVE-2025-48471 fix blocked phtml and phar but missed .pht (as well as .phtm and .phps), which Apache's default FilesMatch handler still runs as PHP. No public exploit or CISA KEV listing is identified at time of analysis, but the technique is well understood and low-complexity given a valid agent account.