FileThingie 2.5.7 Arbitrary File Upload via ft2.php

The primary impact of CVE-2019-25471 is the ability for an attacker to gain arbitrary code execution on a system running FileThingie. By crafting a malicious ZIP archive containing PHP shell scripts and uploading it through the ft2.php endpoint, an attacker can leverage FileThingie's unzip functionality to extract the shell into a publicly accessible directory. Subsequently, the attacker can execute arbitrary commands on the server, potentially leading to data theft, system takeover, or denial of service. The blast radius extends to any sensitive data stored or processed by the FileThingie application, and the attacker could potentially pivot to other systems on the network.

Web applications utilizing FileThingie version 2.5.7 are at significant risk. This includes applications deployed on shared hosting environments where file upload functionality is commonly used. Systems with weak input validation or inadequate WAF protection are particularly vulnerable.

• php: Examine web server access logs for requests to ft2.php containing ZIP files. Look for unusual file extensions or filenames within the uploaded ZIP archives.

grep 'ft2.php' access.log | grep '.zip'

• php: Search for newly created PHP files in publicly accessible directories that may contain malicious code.

find /var/www/html -name '*.php' -type f -mtime -1

• generic web: Monitor for unexpected PHP process executions on the server.

ps aux | grep php

1. 2026-03-11Disclosure

   disclosure

1. Gereserveerd2026-02-22
2. Gepubliceerd2026-03-11
3. Gewijzigd2026-04-07
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2019-25471 is to immediately upgrade FileThingie to version 2.5.8 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file uploads to specific file types, implementing strict input validation on the ft2.php endpoint to prevent ZIP uploads, and configuring a Web Application Firewall (WAF) to block requests containing malicious ZIP files. Monitor access logs for suspicious file upload attempts. After upgrading, confirm the fix by attempting to upload a test ZIP file containing a harmless PHP script and verifying that the upload fails or is properly sanitized.