Multiple Incomplete Blacklist Vulnerabilities in Serendipity by Serendipity Team

CVE-2015-6968

What is CVE-2015-6968?

Multiple incomplete blacklist vulnerabilities exist in the serendipity_isActiveFile function of include/functions_images.inc.php in Serendipity versions prior to 2.0.2. This allows remote authenticated users to exploit the software by uploading malicious files with .pht or .phtml extensions, potentially executing arbitrary PHP code on the server. Organizations using affected versions should apply available security updates to mitigate the risk of unauthorized code execution and enhance overall system security.

References