Critical FreeScout Vulnerability (CVE-2026-28289) Enables Remote Server Takeover via Malicious Emails A newly disclosed vulnerability in FreeScout, an open-source help desk platform, allows attackers to seize control of vulnerable servers by sending a crafted email to a FreeScout mailbox. Tracked as CVE-2026-28289, the flaw is a bypass of a previous patch (CVE-2026-27636) and affects self-hosted instances running on Apache servers with AllowOverride All enabled a common configuration. The vulnerability stems from inadequate file upload restrictions, specifically the exclusion of .htaccess and .user.ini files from the platform’s blocklist. Attackers can exploit this by prepending a Zero-Width Space (U+200B) character to a malicious filename, evading validation checks. Once uploaded, the file such as a malicious .htaccess configuration can redefine server behavior, enabling remote code execution (RCE). Exploitation requires no authentication or user interaction; attackers simply email a payload containing a malicious .htaccess file and a webshell to a FreeScout mailbox. The predictable file storage location allows attackers to access and execute commands via the server’s web interface, leading to full system compromise, data exfiltration (including helpdesk tickets and mailbox content), and potential lateral movement within the network. Researchers at OX Security identified roughly 1,100 publicly exposed FreeScout instances via Shodan, though the exact number of vulnerable deployments remains unclear. Affected organizations span public health institutions, financial services, technology providers, and news organizations, with researchers withholding specific details to prevent targeted attacks. FreeScout v1.8.207 patches the vulnerability, and users are advised to upgrade immediately. Additionally, disabling AllowOverride All in Apache’s configuration mitigates the risk. The flaw underscores the ongoing risks of self-hosted, open-source platforms with insufficient input validation.