CVE-2026-41193: FreeScout Zip Slip path traversal in module installation leading to arbitrary file write
FreeScout versions before 1.8.215 extract ZIP archives during module installation without validating file paths, which is a Zip Slip path traversal (CWE-22). According to the record, an authenticated administrator could use a crafted archive to write files anywhere on the server filesystem, a condition the advisory associates with remote code execution. Version 1.8.215 is reported to fix the issue.
Overview
CVE-2026-41193 affects the module installation feature of FreeScout, a self-hosted help desk and shared mailbox application. The module installer extracts ZIP archives without validating the file paths contained in them, which is a Zip Slip variant of path traversal (CWE-22). The record states that version 1.8.215 fixes the issue.
Impact
- According to the record, an authenticated administrator can write files to arbitrary locations on the server filesystem.
- The CVSS 3.1 vector recorded by GitHub and NVD is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H with a base score of 9.1 (critical).
- The advisory context in the record links this write primitive to possible remote code execution, since a written file may be executed by the application or server.
Affected products and versions
- Product listed in the record: Freescout-help-desk Freescout.
- Affected range: versions before 1.8.215.
- Fixed version: 1.8.215, per the description and the release reference.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is reported in the sources consulted. The record includes an SSVC exploitation value of "poc", which indicates proof-of-concept activity is considered in the assessment, and an EPSS probability of 0.00611. These values are assessment signals, not confirmation of exploitation in the wild.
Remediation and mitigation
- Upgrade FreeScout to version 1.8.215 or later, as indicated by the release reference.
- Until patching is complete, restrict who holds administrator accounts and review administrative access, since the record requires an authenticated administrator.
- Install modules only from trusted sources and verify them before installation.
- Consider restricting write permissions of the web application user on directories outside what the application needs.
Detection guidance
- Review audit logs and recent activity for module installations by administrator accounts, especially unexpected or unfamiliar ones.
- Check the FreeScout module directory and web-accessible paths for files that were not part of expected installations or updates.
- Monitor the file system for newly created or modified files outside the application's normal update paths.
Limitations of the available information
- The record does not provide the list of exact affected products beyond the generic product name, nor the full set of affected version strings between releases.
- The record does not describe a specific proof-of-concept, and this analysis does not include one.
- Whether a particular deployment is exploitable depends on local configuration, which is unknown from the record.
- The release and commit references were not reviewed in full for this analysis; the fix details rely on the record's description.
Frequently asked questions
What is the vulnerability in CVE-2026-41193?
FreeScout's module installer extracts ZIP archives without validating file paths, a Zip Slip path traversal (CWE-22). The record says an authenticated administrator could write files outside the intended directory.
Which version fixes CVE-2026-41193?
The record states that version 1.8.215 fixes the vulnerability, and versions before it are listed as affected.
Is CVE-2026-41193 known to be actively exploited?
It is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.