CVE-2019-25630 PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager

High 8.7 Published 24 Mar 2026 Updated 28 Jul 2026

Authenticated attackers can upload malicious PHP files via the Image Manager to achieve remote code execution in PhreeBooks ERP.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-25630?

CVE-2019-25630 is a high-severity vulnerability in Phreesoft PhreeBooks ERP, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.

Weakness: CWE-434

Which versions are affected by CVE-2019-25630?

It affects 1 product.

Products include Phreesoft Phreebookserp.

How do I fix CVE-2019-25630?

No fix has been published for CVE-2019-25630 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-25630 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25630 exists.

Sources

Also known as GHSA-4f54-m9cc-h3ch.