CVE-2017-6090 is an unrestricted file upload vulnerability in PhpCollab 2.5.1 and earlier, specifically within the clients/editclient.php component. This flaw allows authenticated attackers to upload arbitrary executable files and achieve remote code execution by directly accessing the uploaded file. With a CVSS score of 8.8 (HIGH), this vulnerability is easily exploitable over the network with low privileges and no user interaction, leading to high impact on confidentiality, integrity, and availability. While not listed on the KEV catalog, exploit intelligence indicates readily available Metasploit modules and Nuclei templates, along with ExploitDB entries, suggesting a high likelihood of exploitation. Despite this, there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.5.1CPE matchmatch criteria | cpe:2.3:a:phpcollab:phpcollab:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.