CVE-2015-0258

Collabtive up to version 2.0/2.1 had an avatar-upload input validation flaw in manageuser.php that could enable an authenticated user to upload crafted files (.php3/.php4/.php5/.phtml) and execute arbitrary code. Public advisories (USN-4590-1, DLA-2125-1) and Debian/Nessus entries describe fixes ...