CVE-2017-6090: PhpCollab unrestricted file upload enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote code execution with a high CVSS score, public exploit code and very high EPSS, though it requires at least a low-privileged account and is not in KEV.

What it is

PhpCollab 2.5.1 and earlier fails to restrict file uploads in clients/editclient.php, allowing a file with an executable extension to be stored and then run. Because the uploaded file is reachable directly under logos_clients/, an attacker with a valid account can turn a routine upload into code execution on the server.

Impact

An attacker gains arbitrary code execution with the privileges of the web server, leading to full compromise of the PhpCollab host and any data it can reach.

Attack surface

Reached over the network through clients/editclient.php; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so any authenticated user can attempt it. The description states remote authenticated users, though one reference title calls it unauthenticated, so the exact authentication requirement is not fully consistent in the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.96234, 99.876th percentile) and multiple references carry the Exploit tag, including public Exploit-DB entries, indicating working public exploit code.

What to do

• Upgrade PhpCollab past 2.5.1 to a release that validates upload extensions and content types; if no fixed release exists, retire or isolate the product.
• Restrict upload handling in clients/editclient.php to an allowlist of image extensions and reject executable extensions.
• Store uploaded logos outside the web root or serve them through a handler that never executes them.
• Disable script execution in the logos_clients/ directory via web server configuration.
• Limit accounts that can edit clients and audit existing accounts for unnecessary privileges.

Detection

• Monitor web logs for direct GET requests to files under logos_clients/ with executable extensions such as .php, .phtml, .php5 or .jsp.
• Alert on POST requests to clients/editclient.php that include multipart uploads with executable extensions or unexpected content types.
• Watch for new files appearing in logos_clients/ and for web server child processes spawning shells or unexpected binaries.
• Review file integrity and timestamps in the upload directory for changes outside normal client-logo activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.