CVE-2026-53593: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (`Helper::$restric

highCVSS 8.8CVE-2026-53593

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (Helper::$restricted_extensions) is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/upload (SecureController@upload) stores files with their original extension into the web-accessible directory storage/app/public/uploads/ (served at /storage/uploads/). On the standard Apache + libapache2-mod-php deployment, the default handler <FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$"> executes .pht, so any authenticated agent can upload a .pht web shell and run arbitrary commands as the web-server user (www-data). This is a direct bypass of the fix for CVE-2025-48471, which added phtml/phar but not pht (nor phtm, phps). Version 1.8.224 contains an updated fix.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 8.8
Published: 2026-07-20
Last updated: 2026-07-21
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-53593

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-535930.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-53593	coverage & exploitation status	NVD · CVE.org

Recent advisories for FreeScout is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-53596: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to ve…nvd · 2026-07-20
criticalCVE-2026-53595: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to ve…nvd · 2026-07-20
mediumCVE-2026-53594: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's…nvd · 2026-07-20
mediumCVE-2026-53592: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype…nvd · 2026-07-20
highCVE-2026-53591: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to ve…nvd · 2026-07-20
highCVE-2026-48812: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to ve…nvd · 2026-07-20

CVE-2026-53593: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (`Helper::$restric

Details

Exploitation outlook

Referenced CVEs

Recent advisories for FreeScout is a

More from NVD Recent CVEs