CVE-2019-18952: SibSoft Xfilesharing up.cgi unrestricted file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable arbitrary file upload with a documented RCE chain and CVSS 9.8 warrants critical priority despite the lack of KEV listing.

What it is

SibSoft Xfilesharing through 2.5.1 exposes cgi-bin/up.cgi, which accepts arbitrary file uploads without adequate validation. Chained with CVE-2019-18951, an uploaded .html file containing short codes can be served over HTTP and executed, turning a file upload into remote code execution. The flaw matters because it is network-reachable, unauthenticated and rated critical by CVSS.

Impact

An attacker can upload arbitrary files to the server and, by chaining with CVE-2019-18951, execute code in the context of the web server. That yields full compromise of confidentiality, integrity and availability of the affected host.

Attack surface

Reached over the network via HTTP requests to cgi-bin/up.cgi; the CVSS vector shows no privileges required and no user interaction. The description does not state whether any authentication gate exists on the upload endpoint.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.45361, 98.7th percentile) and public references are tagged Exploit, indicating working exploit material is available. No ransomware association is documented.

What to do

• Upgrade Xfilesharing past 2.5.1 to a fixed release; if no fixed version is available, restrict or disable cgi-bin/up.cgi.
• Enforce server-side validation of uploaded file type, extension and content, and store uploads outside the web root.
• Block direct HTTP access to uploaded files and prevent .html or script content from being served from upload directories.
• Apply the fix for CVE-2019-18951 as well, since the RCE chain depends on it.
• Place the application behind a WAF or reverse proxy that rejects unexpected uploads to cgi-bin/up.cgi.

Detection

• Monitor web logs for POST requests to cgi-bin/up.cgi, especially from unauthenticated or unusual source IPs.
• Alert on newly written files in web-served directories, particularly .html, .cgi, .pl or script extensions.
• Inspect uploaded content for short-code or template markers consistent with the documented exploit chain.
• Correlate upload events with subsequent HTTP requests to the uploaded file path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.