Leefish develops File Thingie, a file-management application whose vulnerability profile centers on web-facing input-handling and file-upload mechanisms, with observed weaknesses including path traversal, cross-site scripting, and unrestricted file uploads. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Leefish over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-25471CRITICAL FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers ca | Mar 11, 2026 | 9.8 | 32 | NO | NO |
CVE-2023-53942HIGH File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a c | Dec 18, 2025 | 8.8 | 28 | NO | NO |
CVE-2026-30579MEDIUM File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a file with a crafted file name used to trig | Mar 20, 2026 | 6.5 | 21 | NO | NO |
CVE-2026-30578MEDIUM File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invoke arbitrary javascript code. | Mar 20, 2026 | 6.5 | 21 | NO | NO |
CVE-2026-30580MEDIUM File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read arbitrary files on the | Mar 20, 2026 | 4.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Leefish.
Media articles that mention a CVE ID that affects a product developed by Leefish — matched by CVE ID, not by vendor name.