{"uuid": "524a0147-f9e8-4d76-9132-4b21177e509c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27636", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/freescout_htaccess_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd, x86, x64\", \"author\": [\"offensiveee\", \"Nir Zadok (nirzadokox) \", \"Moses Bhardwaj (MosesOX) \", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443, 25, 465, 587, 2525, 25025, 25000], \"autofilter_services\": [\"http\", \"https\", \"smtp\", \"smtps\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution vulnerability\\n          in FreeScout <= 1.8.206 (CVE-2026-28289). The sanitizeUploadedFileName()\\n          function checks for dot-prefixed filenames before stripping Unicode format\\n          characters (ZWSP U+200B), allowing .htaccess upload via email attachment.\\n\\n          A crafted email is sent via SMTP to a FreeScout mailbox. When fetched by\\n          the IMAP/POP3 cron (typically every 60s), the ZWSP is stripped and the\\n          attachment is stored as .htaccess. The file uses SetHandler to make itself\\n          executable as PHP, achieving code execution when requested via HTTP.\\n\\n          Requires a valid mailbox email address and web-accessible attachment\\n          storage (storage:link pointing to storage/app/).\", \"disclosure_date\": \"2026-03-01\", \"fullname\": \"exploit/multi/http/freescout_htaccess_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Mail2Shell\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/freescout_htaccess_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/freescout_htaccess_rce\", \"references\": [\"CVE-2026-28289\", \"CVE-2026-27636\", \"GHSA-5gpc-65p8-ffwp\", \"GHSA-mw88-x7j3-74vc\", \"URL-https://www.ox.security/blog/freescout-rce-cve-2026-28289/\", \"URL-https://www.ox.security/blog/freescout-rce-cve-2026-27636/\"], \"rport\": 25, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Linux Dropper\", \"Windows Command Shell\", \"Windows Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:47.308968Z"}