Skip to main content

Ubuntu EUVDEUVD-2014-0506

| CVE-2014-0468 CRITICAL
Unrestricted Upload of File with Dangerous Type (CWE-434)
2025-06-26 security@debian.org
File Upload Apache Ubuntu Debian Fusionforge
Critical
Disputed · 9.8 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 23:54 euvd
EUVD-2014-0506
Analysis Generated
Mar 15, 2026 - 23:54 vuln.today
CVE Published
Jun 26, 2025 - 21:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Vulnerability in fusionforge in the shipped Apache configuration, where the web server may execute scripts that the users would have uploaded in their raw SCM repositories (SVN, Git, Bzr...). This issue affects fusionforge: before 5.3+20140506.

Analysis

Vulnerability in fusionforge in the shipped Apache configuration, where the web server may execute scripts that the users would have uploaded in their raw SCM repositories (SVN, Git, Bzr...). This issue affects fusionforge: before 5.3+20140506.

Technical ContextAI

Unrestricted file upload allows attackers to upload malicious files (web shells, executables) that can then be executed on the server. This vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434).

RemediationAI

Validate file types by content (magic bytes), not just extension. Store uploads outside the web root. Use random filenames. Scan uploads for malware.

More in Fusionforge

View all
CVE-2015-0850 CRITICAL
10.0 Jun 02

The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parame
CVE-2013-1423 MEDIUM
6.9 Mar 14

(1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group_

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2020-36847 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2016-6600 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8
CVE-2015-8249 CRITICAL POC
9.8

Vendor StatusVendor

Ubuntu

Priority: Medium
fusionforge
Release Status Version
precise ignored end of life
trusty DNE -
upstream released 5.3+20140506-1
vivid DNE -
wily not-affected 6.0.2+20150708-1
xenial not-affected 6.0.2+20150708-1
yakkety not-affected 6.0.2+20150708-1
zesty not-affected 6.0.2+20150708-1

Debian

fusionforge
Release Status Fixed Version Urgency
squeeze fixed (unfixed) end-of-life
(unstable) fixed 5.3+20140506-1 -

Share

EUVD-2014-0506 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy