PT-2026-24769 · Filethingie · File Thingie

Cakes · Publicado 2026-03-11 · Atualizado 2026-03-11 · CVE-2019-25471

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FileThingie version 2.5.7

Description The software contains an arbitrary file upload issue that allows attackers to upload malicious files. This is achieved by sending ZIP archives through the 'ft2.php' endpoint. Attackers can upload ZIP files containing PHP shells, utilize the unzip functionality to extract them into accessible directories, and then execute arbitrary commands through the extracted PHP files. The vulnerable parameter is the file uploaded to the 'ft2.php' endpoint.

Recommendations Apply a fix for FileThingie version 2.5.7.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-25471

Produtos afetados

File Thingie

Referências · 5

• 🔥 https://exploit-db.com/exploits/47349 · Exploit
• https://github.com/leefish/filethingie/archive/master.zip · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25471 · Nota de Segurança
• https://vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ftphp · Nota
• https://vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php · Nota