CVE-2015-0258

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-02-17 · updated 2026-06-17
Weakness: CWE-434

Description

Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.

Affected products

Canonical Ubuntu Linux: 16.04
Debian Linux: 8.0
O-Dyn Collabtive: before 2.1 — fixed in 2.1

How to fix

Upgrade to a fixed version: O-Dyn Collabtive 2.1. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/133736/Collabtive-2.0-Shell-Upload.html
https://github.com/philippK-de/Collabtive/commit/9ce6301583669d0a8ecb4d23fb56e34b68511335
https://lists.debian.org/debian-lts-announce/2020/02/msg00031.html
https://usn.ubuntu.com/4590-1/
http://packetstormsecurity.com/files/133736/Collabtive-2.0-Shell-Upload.html
https://github.com/philippK-de/Collabtive/commit/9ce6301583669d0a8ecb4d23fb56e34b68511335
https://lists.debian.org/debian-lts-announce/2020/02/msg00031.html
https://usn.ubuntu.com/4590-1/

Get alerted when CVE-2015-0258 or the next vulnerability affects your stack