Description
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Collabtive | before 2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | collabtive | 2.0+dfsg-5+deb8u1 | DLA-2125-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | collabtive | 2.0+dfsg-6ubuntu1.1 | USN-4590-1 |
Advisories 2
- DLA-2125-1 collabtive - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4590-1 collabtive vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026