FreeScout instances running version 1.8.206 or earlier are vulnerable to a patch‑bypass that allows an authenticated user with file‑upload privileges to upload a malicious .htaccess file. The vulnerability arises from a TOCTOU flaw in the sanitizeUploadedFileName() function, which permits a zero‑width space prefix to evade the dot‑file check before sanitization. When exploited, this flaw permits arbitrary code execution on the server, giving the attacker full control over the underlying system.

The affected product is the Freescout help‑desk application. All installations of Freescout 1.8.206 or older, when an authenticated user has permission to upload files, are susceptible. The issue is specific to the Laravel‑based implementation of file handling in Freescout.

The CVSS score of 10 indicates a critical severity. With an EPSS of 22%, exploit probability is moderate to high. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires only that the user be authenticated and possess file‑upload rights; no additional privileges are necessary. Once the malicious .htaccess file is uploaded, the attacker can achieve remote code execution with full control over the server.