CVE-2019-12185

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

• CWE-434

• http://incidentsecurity.com/elabftw-1-8-5-entitycontroller-arbitrary-file-upload-rce/Exploit, Vendor Advisory, URL Repurposed
• https://github.com/fuzzlove/eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCEExploit, Third Party Advisory
• http://incidentsecurity.com/elabftw-1-8-5-entitycontroller-arbitrary-file-upload-rce/Exploit, Vendor Advisory, URL Repurposed
• https://github.com/fuzzlove/eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCEExploit, Third Party Advisory

Published

May 20, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1218A spoofing vulnerability exists in the way Microsoft Outlook…
• CVE-2019-12180An issue was discovered in SmartBear ReadyAPI through 2.8.2 …7.8
• CVE-2019-12181A privilege escalation vulnerability exists in SolarWinds Se…8.8
• CVE-2019-12182Directory Traversal in Safescan Timemoto and TA-8000 series …9.8
• CVE-2019-12183Incorrect Access Control in Safescan Timemoto TM-616 and TA-…7.5
• CVE-2019-12184There is XSS in browser/components/MarkdownPreview.js in Boo…
• CVE-2019-12186An issue was discovered in Sylius products. Missing input sa…4.8
• CVE-2019-12189An issue was discovered in Zoho ManageEngine ServiceDesk Plu…
• CVE-2019-1219An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-12190XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS W…
• CVE-2019-12193H3C H3Cloud OS all versions allows SQL injection via the ear…
• CVE-2019-12195TP-Link TL-WR840N v5 00000005 devices allow XSS via the netw…