An unrestricted file upload vulnerability in FreeScout allows authenticated attackers to potentially achieve remote code execution on the underlying server.

The application is susceptible to an unrestricted file upload of dangerous types (CWE-434). This flaw allows an authenticated user to upload malicious files, which could lead to arbitrary code execution if the server processes the uploaded file.

Successful exploitation of this vulnerability allows an authenticated attacker to compromise the server integrity and gain full control over the help desk environment. Given the CVSS score of 8.8, the potential for unauthorized access and total system compromise makes this a high priority for security teams.

Immediate Action: Upgrade FreeScout to version 1.8.224 or later to address the file upload validation flaw.

Proactive Monitoring: Review file upload logs and scan the application server directories for suspicious files or executable scripts located in upload paths.

Compensating Controls: Implement strict file type validation at the WAF level and restrict write permissions for the web server user on upload directories.

Public Exploit Available: No confirmed public exploit in the available data.

Organizations should update their FreeScout installation to the latest version as soon as possible. Restricting user permissions and ensuring that only authorized individuals have access to file upload features will further reduce the risk of exploitation.