CVE-2026-28289: critical vulnerability in freescout-help-desk freescout

FreeScout 1.8.206 allows authenticated users to upload malicious files by hiding dangerous filenames with invisible characters, bypassing security checks and taking control of the server. This is a critical flaw because attackers with basic upload permissions can execute any code they want.

An authenticated attacker with file upload permissions exploits a TOCTOU vulnerability in sanitizeUploadedFileName() by prefixing a malicious .htaccess filename with a zero-width space character. The security check validates the filename before invisible character sanitization occurs, allowing the dangerous file to be written to the server and executed, resulting in arbitrary remote code execution.