📖 Overview

CVE-2026-28289, nicknamed Mail2Shell, is a critical zero-click Remote Code Execution (RCE) vulnerability affecting FreeScout.

An attacker can send a specially crafted email to a FreeScout mailbox and gain remote shell access to the underlying server — without authentication and without user interaction.

🧠 Vulnerability Summary

⚙️ Technical Breakdown

📨 Step 1 — Malicious Email Delivery

Attacker sends an email with a specially crafted attachment.

🧩 Step 2 — Filename Sanitization Bypass

FreeScout attempts to block dangerous files like .htaccess, but the attacker:

• Prepends a zero-width Unicode character
• Bypasses filename validation
• File is saved as a valid executable server file

💣 Step 3 — Remote Execution

The attacker accesses the uploaded file via web path and executes arbitrary commands.

Result:

# Remote shell access achieved
whoami
www-data

✅ If the operation is successful, here is EXACTLY what you will see (step by step):

1. In your terminal (right after running the script)

✅ Email sent successfully! (Zero-Click RCE triggered)

You will also see the instructions for the next steps printed.

2. When you run the find command on your FreeScout server via SSH

It will immediately return the full real path to the uploaded file, for example:

/var/www/html/storage/attachment/2026/03/05/15/webshell.txt

(or similar date/time folder — this confirms FreeScout saved the attachment automatically).

3. The REAL proof of success — in your browser (this is the moment you know you have full RCE)

Copy the path from step 2 and open this URL:

http://your-freescout-domain.com/storage/attachment/2026/03/05/15/webshell.txt?cmd=whoami

You will see this exact output (plain text):

www-data

(Or whatever the Apache/PHP user is on your server — usually www-data, apache, or nobody).

Now change the command and refresh:

http://your-freescout-domain.com/storage/attachment/2026/03/05/15/webshell.txt?cmd=id

You will see:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

And for ls -la:

total 12
drwxr-xr-x 2 www-data www-data 4096 Mar  5 15:00 .
drwxr-xr-x 8 www-data www-data 4096 Mar  5 14:00 ..
-rw-r--r-- 1 www-data www-data   87 Mar  5 15:00 webshell.txt

This output appears directly in the browser page (inside <pre> tags from the webshell). No error, no PHP source code, no 404.

This means you have full remote code execution on the server — the .htaccess + zero-width space bypass worked perfectly, and the email attachment was processed without any user interaction.

🎯 Why This Is Dangerous

• ⚡ Zero-click exploitation
• 🌐 Remote attack surface (email)
• 🔓 No authentication required
• 🧨 Full RCE capability
• 📂 Potential data exfiltration
• 🔁 Lateral movement inside internal networks

📦 Affected Versions

All versions of FreeScout:

<= 1.8.206

✅ Patched Version

Upgrade immediately to:

1.8.207 or later

🛡️ Mitigation Steps

1️⃣ Immediate Action

• Upgrade FreeScout to the latest version

2️⃣ Harden Web Server

• Disable AllowOverride All in Apache config
• Restrict execution inside attachment directories

3️⃣ Monitor Logs

Look for:

• Suspicious .htaccess files
• Unusual attachment uploads
• Direct access attempts to /storage/attachments/

🔍 Detection Tips

Indicators of compromise may include:

• Unknown .htaccess files in attachment folders
• Outbound traffic spikes
• Web server spawning shell processes
• Suspicious POST/GET requests to attachment paths

🧪 Proof-of-Concept (Conceptual)

Email → Malicious Attachment (Unicode prefixed filename)
        ↓
Saved to predictable path
        ↓
Web-accessible execution
        ↓
Remote shell

📌 Related Vulnerability

This issue bypassed protections added in:

• CVE-2026-27636

Demonstrating incomplete filename sanitization logic.

📊 Impact Assessment

🧩 Lessons Learned

• Unicode handling must be normalized before validation
• Never rely solely on filename filtering
• Attachment directories should never allow code execution
• Zero-click vectors are high-risk attack surfaces

📚 References

• FreeScout Security Advisory
• NVD Entry for CVE-2026-28289