FreeScout, a free self-hosted help desk and shared mailbox application, contains a path traversal vulnerability in its module installation feature. Prior to version 1.8.215, the application extracts ZIP archives without validating file paths, allowing authenticated administrators to write files arbitrarily on the server filesystem via specially crafted ZIP files. This vulnerability enables arbitrary file write attacks that could lead to remote code execution or system compromise. The issue has been addressed in version 1.8.215 with proper path validation during ZIP extraction.