VulnSocial

CVE-2026-41193Disclosure

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP. Version 1.8.215 fixes the vulnerability.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 3 mentions (2026-04-21); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-04-21: 3Mentions · 2026-04-22: 1Technical Details · 2026-04-21: 3Technical Details · 2026-04-22: 104-2104-22
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-04-213
Disclosure3
2026-04-221
Disclosure1
Full discourse4 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-41193 Arbitrary File Write in FreeScout Prior to Version 1.8.215 via Path Traversal https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41193

    Post summary

    A path‑traversal vulnerability allowing arbitrary file write was disclosed for FreeScout versions before 1.8.215; no PoC, exploit, or remediation details are included.

    0000045
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-41193 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validati… https://www.cve.org/CVERecord?id=CVE-2026-41193 ----- Traducción: CVE-2026-41193 Fre… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-41193 for FreeScout, noting unvalidated ZIP extraction, but offers no PoC, exploit code, or patch details.

    0000026
    72 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-41193 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validati… https://www.cve.org/CVERecord?id=CVE-2026-41193

    Post summary

    CVE-2026-41193 identifies unvalidated ZIP extraction in FreeScout modules before v1.8.215; no PoC, exploit, active exploitation, or patch is disclosed.

    00000154
    57.2K followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2026-41193: FreeScout has Zip Slip path trav... Classic zip slip in FreeScout's module installer - admin-only but trivial to chain with stolen creds for full server co... https://zerodaysignal.com/vulnerability/CVE-2026-41193 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    A Zip Slip vulnerability (CVE-2026-41193) has been disclosed in FreeScout's module installer, potentially exploitable by admin users and chainable with stolen credentials for full server compromise.

    0000067
    218 followersView on X

Explore more

Back to dashboard