CVE-2019-12185

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component

published May 19, 2019

CVSS
—
EPSS
17%
Percentile
97.1
In the wild
Unconfirmed
What it is

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.17336 · 97.1th percentile
Published
2019-05-19T23:05Z
EPSS history
Timeline
  • 19 MAY 23:05Z
    eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component
    cvelistv5