Description
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | phpgroupware | 0.9.16.005-3.sarge5 | DSA-1063-1 |
| Debian 3.0 | phpgroupware | 0.9.14-0.RC3.2.woody6 | DSA-1063-1 |
Advisories 1
- DSA-1063-1 phpgroupware - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20050828 FUD Forum < 2.7.1 PHP code injection vurnelability mailing-list
- 16627 third-party-advisory
- fudforum-avatar-file-upload(22076) vdb-entry
- 20203 third-party-advisory
- http://fudforum.org/forum/index.php?t=msg&th=5470&start=0&
- 14678 vdb-entry
- DSA-1063 vendor-advisory
- 20090127 Re: FUD Forum < 2.7.1 PHP code injection vurnelability mailing-list