CVE-2026-53593 affects FreeScout help desk software versions before 1.8.224. The vulnerability arises because the denylist for dangerous file extensions in the upload functionality does not include the .pht extension. The upload endpoint stores files with their original extensions in a web-accessible directory. On typical Apache + libapache2-mod-php setups, .pht files are executed as PHP scripts. Consequently, any authenticated user can upload a .pht web shell and execute arbitrary commands with the privileges of the web server user (www-data). This issue bypasses the prior fix for CVE-2025-48471, which did not cover .pht files. Version 1.8.224 includes an updated fix that addresses this gap.

An authenticated attacker can upload a .pht web shell to the server and execute arbitrary commands as the web server user, leading to full compromise of the web application environment. This includes potential data theft, service disruption, and further lateral movement within the affected system.

Upgrade FreeScout to version 1.8.224 or later, which includes the updated fix that properly restricts dangerous file extensions including .pht. Until upgraded, restrict authenticated user file uploads or implement additional server-side controls to block execution of uploaded files with dangerous extensions.