CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php
in Dotclear before 2.8.2 allow remote authenticated users with “manage
their own media items” and “manage their own entries and comments”
permissions to execute arbitrary PHP code by uploading a file with a (1)
.pht, (2) .phps, or (3) .phtml extension.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815979&gt;