CVE-2019-18952

Name of the Vulnerable Software and Affected Versions Xfilesharing versions through 2.5.1

Description The issue allows for arbitrary file upload via the cgi-bin/up.cgi endpoint. This can potentially be combined with other issues to achieve remote code execution by uploading a .html file containing short codes, served over HTTP.

Recommendations For versions through 2.5.1, consider restricting access to the cgi-bin/up.cgi endpoint to prevent arbitrary file uploads until a fix is available. As a temporary workaround, avoid using the vulnerable upload functionality in the cgi-bin/up.cgi endpoint.