CVE-2026-53593 freescout-help-desk CVE debrief

Who should care

Defenders responsible for FreeScout installations, especially those with authenticated access to the application, should assess exposure and prioritize patching or mitigation. This includes IT administrators, security teams, and operators who manage FreeScout deployments. They should review the vulnerability details, assess the potential impact, and take necessary actions to protect their systems. Additionally, security teams should monitor for suspicious

Why it matters

CVE-2026-53593 is a high-severity vulnerability in FreeScout that allows authenticated users to upload and execute arbitrary code. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where authenticated access to the FreeScout application is possible.

• Authenticated users can upload and execute arbitrary code
• Potential for lateral movement within the network
• Elevation of privileges for the web-server user
• Possible data breaches or unauthorized access

Technical summary

FreeScout, a free help desk and shared inbox built with PHP's Laravel framework, is vulnerable to an authenticated web shell upload. The denylist for dangerous file uploads is incomplete, allowing `.pht` files to be uploaded. An authenticated user can upload a `.pht` web shell and run arbitrary commands as the web-server user. This vulnerability bypasses the fix for CVE-2025-48471, which added `phtml`/`phar` but not `pht`. The vulnerability has a CVSS score of 8.8 and is considered high-severity. Defenders should prioritize patching or mitigating this vulnerability.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where authenticated access to the FreeScout application is possible.

Recommended defensive actions

• Patch FreeScout to version 1.8.224 or later
• Restrict access to the FreeScout application
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.8 and the affected version of FreeScout. A GitHub security advisory (GHSA-27vp-fpg8-j8wv) is also available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.