CVE-2019-25471 FileThingie 2.5.7 Arbitrary File Upload via ft2.php

Critical 9.3 Published 11 Mar 2026 Updated 7 Apr 2026

Attackers can upload malicious ZIP archives containing PHP shells to execute arbitrary commands on the server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-25471?

CVE-2019-25471 is a critical vulnerability in FileThingie, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files.

Weakness: CWE-22

Which versions are affected by CVE-2019-25471?

It affects 1 product.

Products include Leefish File Thingie.

How do I fix CVE-2019-25471?

No fix has been published for CVE-2019-25471 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-25471 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25471 exists.

Sources

Also known as GHSA-6w2p-gpfw-mwh2.