CVE-2019-25471

Katalog CVE

CVSS 9.8 · Critical EPSS 0,92%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada leefish file thingie. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.exploit-db.com/exploits/47349 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php advisory pihak ketiga
• https://github.com/leefish/filethingie/archive/master.zip product