CVE-2026-41193: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in freescout-help-desk freescout
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP. Version 1.8.215 fixes the vulnerability.
AI Analysis
Technical Summary
CVE-2026-41193 is a path traversal vulnerability (CWE-22) in FreeScout's module installation feature prior to version 1.8.215. The vulnerability occurs because the application extracts ZIP archives without validating the contained file paths, enabling an authenticated admin user to write files arbitrarily on the server filesystem. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The issue is fixed in FreeScout version 1.8.215.
Potential Impact
An authenticated administrator can exploit this vulnerability to write arbitrary files anywhere on the server filesystem, potentially leading to full system compromise including code execution, data corruption, or denial of service. The CVSS score of 9.1 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.215 or later, where this vulnerability is fixed. Since this is a self-hosted product, administrators must apply the update manually. There is no official vendor advisory provided here, but the version update is the confirmed remediation. Patch status is confirmed by the version fix note.
CVE-2026-41193: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in freescout-help-desk freescout
Description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP. Version 1.8.215 fixes the vulnerability.
CVSS v3.1
Score 9.1critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-41193 is a path traversal vulnerability (CWE-22) in FreeScout's module installation feature prior to version 1.8.215. The vulnerability occurs because the application extracts ZIP archives without validating the contained file paths, enabling an authenticated admin user to write files arbitrarily on the server filesystem. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The issue is fixed in FreeScout version 1.8.215.
Potential Impact
An authenticated administrator can exploit this vulnerability to write arbitrary files anywhere on the server filesystem, potentially leading to full system compromise including code execution, data corruption, or denial of service. The CVSS score of 9.1 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.215 or later, where this vulnerability is fixed. Since this is a self-hosted product, administrators must apply the update manually. There is no official vendor advisory provided here, but the version update is the confirmed remediation. Patch status is confirmed by the version fix note.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-18T02:51:52.973Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e7b7ed19fe3cd2cdec7cd0
Added to database: 4/21/2026, 5:46:21 PM
Last enriched: 4/21/2026, 6:01:11 PM
Last updated: 6/3/2026, 7:21:06 PM
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.