The vulnerability stems from the free help desk platform’s file‑upload filter failing to block files named ".htaccess" or ".user.ini". An authenticated user can upload a malicious ".htaccess" file to the server. On hosts that run Apache with the common AllowOverride All setting, that file can alter how PHP or the web server processes files, giving the attacker the ability to execute arbitrary code on the host. The flaw is a classic example of unrestricted upload of a dangerous file type, identified as CWE‑434. The potential impact is full control of the web application and possibly the underlying host, compromising confidentiality, integrity, and availability. Affected systems are all installations of the FreeScout help‑desk platform older than version 1.8.206 running on an Apache web server configured with AllowOverride All. The relevant product is the FreeScout help‑desk, and any authenticated user who can upload files is able to trigger the flaw.

Affected systems are all installations of the FreeScout help‑desk platform older than version 1.8.206 running on an Apache web server configured with AllowOverride All. The relevant product is the FreeScout help‑desk, and any authenticated user who can upload files is able to trigger the flaw.

Risk assessment shows a CVSS score of 8.8, indicating a high severity vulnerability, with an EPSS score of 22 % that suggests a non‑negligible exploitation probability. The flaw is not yet listed in the CISA KEV catalog. Exploitation requires an authenticated uploading privilege and a permissive Apache configuration; it can also be combined with another related vulnerability to increase damage. Enterprise deployments should treat this as a critical threat.