CVE-2019-25471CWE-22path-traversal

CVE-2019-25471

Critical · published March 11, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00919 · 59.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-11T23:16Z
Affected products (1)
ProductVersionsFixed in
leefish/file_thingie≤ 2.5.7—
References (3)
https://github.com/leefish/filethingie/archive/master.zip · [email protected]https://www.exploit-db.com/exploits/47349 · [email protected]https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php · [email protected]
EPSS history
Timeline
  • 11 MAR 18:23Z
    FileThingie 2.5.7 Arbitrary File Upload via ft2.php
    cvelistv5