CVE-2019-12185

CVE-2019-12185 describes an arbitrary file upload vulnerability in eLabFTW version 1.8.5, specifically within the /app/controllers/EntityController.php component. This flaw allows an authenticated attacker to upload malicious PHP files to the web root, leading to remote command execution and full system compromise. With a CVSS score of 8.8 (High), the vulnerability is easily exploitable over the network with low privileges and no user interaction, resulting in high impacts to confidentiality, integrity, and availability. While not listed on the KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.