PT-2026-24769 · Filethingie · File Thingie

Cakes · Published 2026-03-11 · Updated 2026-03-11 · CVE-2019-25471

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FileThingie version 2.5.7

Description The software contains an arbitrary file upload issue that allows attackers to upload malicious files. This is achieved by sending ZIP archives through the 'ft2.php' endpoint. Attackers can upload ZIP files containing PHP shells, utilize the unzip functionality to extract them into accessible directories, and then execute arbitrary commands through the extracted PHP files. The vulnerable parameter is the file uploaded to the 'ft2.php' endpoint.

Recommendations Apply a fix for FileThingie version 2.5.7.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-25471

Affected Products

File Thingie

References · 5

• 🔥 https://exploit-db.com/exploits/47349 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25471 · Security Note
• https://github.com/leefish/filethingie/archive/master.zip · Note
• https://vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ftphp · Note
• https://vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php · Note