CVE-2015-0258 — Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension

Back Back to CVE browser

HIGH

Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension

Published Feb 17, 2020

8.8

HIGH

CVSS 3.1

EPSS 3.78%

Description

Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.

Affected products

Vendor n/a Product Collabtive Default
n/a
- Version
  before 2.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Collabtive

n/a

Version	Status	Constraints
before 2.1	affected	-

Remediation

No remediation recorded yet.

Metrics

3.78% 0.03781

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03781

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (24 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.78% (0.03781)	89.61th	v5 (v2026.06.15)
Jun 15, 2026	3.78% (0.03781)	88.52th	v5 (v2026.06.15)
May 29, 2026	12.94% (0.12936)	94.18th	v4 (v2025.03.14)
May 26, 2026	15.82% (0.15820)	94.83th	v4 (v2025.03.14)
May 24, 2026	12.94% (0.12936)	94.15th	v4 (v2025.03.14)
May 22, 2026	16.50% (0.16497)	94.98th	v4 (v2025.03.14)
May 13, 2026	13.51% (0.13514)	94.29th	v4 (v2025.03.14)
Dec 28, 2025	16.50% (0.16497)	94.68th	v4 (v2025.03.14)
Dec 27, 2025	11.88% (0.11883)	93.54th	v4 (v2025.03.14)
Oct 28, 2025	16.50% (0.16497)	94.60th	v4 (v2025.03.14)
Oct 27, 2025	11.88% (0.11883)	93.46th	v4 (v2025.03.14)
Oct 2, 2025	16.50% (0.16497)	94.69th	v4 (v2025.03.14)
Oct 1, 2025	13.51% (0.13514)	94.01th	v4 (v2025.03.14)
Jul 30, 2025	11.88% (0.11883)	93.45th	v4 (v2025.03.14)
Mar 30, 2025	13.51% (0.13514)	93.61th	v4 (v2025.03.14)
Mar 29, 2025	31.33% (0.31327)	94.92th	v4 (v2025.03.14)
Mar 19, 2025	13.51% (0.13514)	93.38th	v4 (v2025.03.14)
Mar 17, 2025	11.99% (0.11986)	93.21th	v4 (v2025.03.14)
Dec 12, 2024	1.75% (0.01747)	88.44th	v3 (v2023.03.01)
Mar 22, 2023	1.96% (0.01957)	86.88th	v3 (v2023.03.01)
Mar 7, 2023	2.28% (0.02277)	87.89th	v3 (v2023.03.01)
Mar 6, 2023	4.57% (0.04571)	88.92th	v2 (v2022.01.01)
Apr 1, 2022	4.57% (0.04571)	87.83th	v2 (v2022.01.01)
Feb 4, 2022	4.57% (0.04571)	74.15th	v2 (v2022.01.01)

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (4)

http://packetstormsecurity.com/files/133736/Collabtive-2.0-Shell-Upload.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/philippK-de/Collabtive/commit/9ce6301583669d0a8ecb4d23fb56e34b68511335
x_refsource_MISCPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00031.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://usn.ubuntu.com/4590-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/133736/Collabtive-2.0-Shell-Upload.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/philippK-de/Collabtive/commit/9ce6301583669d0a8ecb4d23fb56e34b68511335		x_refsource_MISCPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00031.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://usn.ubuntu.com/4590-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory