Leefish File Thingie
5 CVEs affecting Leefish File Thingie. Latest disclosed: 2026-03-20. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25471 | Critical | 9.8 | 2026-03-11 | FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php e… |
CVE-2023-53942 | High | 8.8 | 2025-12-18 | File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Att… |
CVE-2026-30579 | Medium | 6.5 | 2026-03-20 | File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a file with a crafted f… |
CVE-2026-30578 | Medium | 6.5 | 2026-03-20 | File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invoke arbitrary javas… |
CVE-2026-30580 | Medium | 4.3 | 2026-03-20 | File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read ar… |