Unrestricted file uploads in FreeScout versions prior to 1.8.224 allow an authenticated user to upload a file with the .pht extension. Because the application stores the file with its original extension in a publicly served directory and the default Apache configuration treats .pht files as executable PHP, the uploaded file can act as a web shell that runs as the web‑server user (www‑data). This bypasses the earlier fix for CVE-2025-48471 that added phtml and phar to the blocked list but omitted pht. The result is that an attacker can execute arbitrary commands on the host with web‑server privileges.

FreeScout help‑desk and shared inbox software built on Laravel, version 1.8.223 and earlier. Deployment environments that use Apache with the libapache2-mod-php module and serve uploaded files from the public uploads directory are impacted.

The CVSS score of 8.8 indicates high severity. The EPSS score is < 1%, indicating a low observed exploitation probability, yet the flaw remains critical because it involves direct code execution. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only legitimate authentication and permission to upload files; an authenticated agent can upload a .pht file and have it executed as the web‑server user. No additional preconditions or privilege escalation steps are needed, making the vulnerability straightforward to exploit once credentials are obtained.