CVE-2019-25471

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25471
FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/leefish/filethingie/archive/master.zip Product
https://www.exploit-db.com/exploits/47349 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:leefish:file_thingie:*:*:*:*:*:*:*:*
History

13 Apr 2026, 14:25

Type Values Removed Values Added
References () https://github.com/leefish/filethingie/archive/master.zip - () https://github.com/leefish/filethingie/archive/master.zip - Product
References () https://www.exploit-db.com/exploits/47349 - () https://www.exploit-db.com/exploits/47349 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php - () https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php - Third Party Advisory
First Time Leefish
Leefish file Thingie
Summary
  • (es) FileThingie 2.5.7 contiene una vulnerabilidad de carga arbitraria de archivos que permite a los atacantes cargar archivos maliciosos enviando archivos ZIP a través del endpoint ft2.php. Los atacantes pueden cargar archivos ZIP que contengan shells PHP, utilizar la funcionalidad de descompresión para extraerlos en directorios accesibles y ejecutar comandos arbitrarios a través de los archivos PHP extraídos.
CPE cpe:2.3:a:leefish:file_thingie:*:*:*:*:*:*:*:*

11 Mar 2026, 22:16

Type Values Removed Values Added
References
  • {'url': 'https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ftphp', 'source': 'disclosure@vulncheck.com'}
  • () https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php -

11 Mar 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-11 19:16

Updated : 2026-04-13 14:25

NVD link : CVE-2019-25471

Mitre link : CVE-2019-25471

CVE.ORG link : CVE-2019-25471

JSON object : View

Products Affected

leefish

  • file_thingie
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')