CVE-2019-25471
Published: 11 March 2026
Summary
CVE-2019-25471 is a critical-severity Path Traversal (CWE-22) vulnerability in Leefish File Thingie. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25471 is an arbitrary file upload vulnerability in FileThingie 2.5.7, affecting the ft2.php endpoint. The flaw allows attackers to upload malicious files by sending ZIP archives, which the application processes using its unzip functionality to extract contents into accessible directories. This enables the inclusion of PHP shells or other malicious payloads within the archives.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low attack complexity and no user interaction required, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapping to CWE-22. Successful exploitation allows attackers to execute arbitrary commands through the extracted PHP files, achieving high impacts on confidentiality, integrity, and availability via remote code execution.
Advisories and related resources, including the Vulncheck advisory at https://www.vulncheck.com/advisories/filethingie-arbitrary-file-upload-via-ft2-php, Exploit-DB entry at https://www.exploit-db.com/exploits/47349, and FileThingie source archive at https://github.com/leefish/filethingie/archive/master.zip, provide further details on exploitation and potential mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19746
Vulnerability details
FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible…
more
directories, and execute arbitrary commands through the extracted PHP files.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing web application (T1190) enables uploading and extracting PHP web shells (T1100) for remote code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the arbitrary file upload flaw in FileThingie 2.5.7's ft2.php endpoint to prevent exploitation via malicious ZIP archives.
Validates uploaded ZIP archives and their contents at the ft2.php endpoint to block malicious PHP shells from being processed and extracted.
Restricts file uploads at the ft2.php endpoint to safe, non-executable types excluding ZIP archives and PHP files containing potential shells.