CVE-2019-25471 | FileThingie 2.5.7 contains an arbitrary file upload vulnerab… | CVSS 9.8 CRITICAL

Description

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files.

Metadata

CVE ID: CVE-2019-25471
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-22 14:42 UTC
Published: 2026-03-11 18:23 UTC
Last updated: 2026-04-07 14:04 UTC
Primary CWE: CWE-22
CWE-22 Improper Limitation of a Pathname to a Restricted Dir…
Vendor / Product: filethingie / FileThingie
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
filethingie	FileThingie	—	2.5.7

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-47349 https://www.exploit-db.com/exploits/47349
Product Reference https://github.com/leefish/filethingie/archive/master.zip
VulnCheck Advisory: FileThingie 2.5.7 Arbitrary File Upload via ft2.php https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php