Executive brief
FileThingie, a web-based file management tool, contains a security flaw that allows logged-in users to access files they should not be able to see. By sending a specially crafted web request, an attacker can bypass security filters to download sensitive system files or configuration data from the server. This could lead to the exposure of passwords, source code, or other private information stored on the hosting server.
Technical details
A path traversal vulnerability exists in FileThingie 2.5.7 due to an inconsistent use of PHP superglobals during input sanitization. The application's 'ft_sanitize_request' function attempts to strip directory traversal sequences (../) from the '$_REQUEST' array; however, the download controller ('method=getfile') subsequently uses the raw, unsanitized '$_GET' array to open files via 'fopen()'. Because unsetting a key in '$_REQUEST' does not affect '$_GET' in PHP, an authenticated attacker can bypass the filter. By providing a path like '../../../../etc/passwd' in the 'file' parameter, an attacker can read any file on the filesystem that the web server user has permissions to access.
Affected products
- Andreas Haugstrup Pedersen FileThingie 2.5.7
Timeline
- 2026-07-20: disclosed: CVE published to NVD