CVE-2017-6090

HIGH EXPLOITED NUCLEI LAB

PhpCollab < 2.5.1 - Authenticated Arbitrary File Upload via Client Logo Upload

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2017-6090 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including Metasploit, Sysdream, jlk, including a Metasploit module exploits/unix/webapp/phpcollab_upload_exec. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated file upload vulnerability in phpCollab 2.5.1, allowing arbitrary PHP code execution under the context of the web server user. It uploads a malicious PHP file via a multipart form request and triggers it to achieve RCE.

Description

Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/43519

This Metasploit module exploits an unauthenticated file upload vulnerability in phpCollab 2.5.1, allowing arbitrary PHP code execution under the context of the web server user. It uploads a malicious PHP file via a multipart form request and triggers it to achieve RCE.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: phpCollab 2.5.1
No auth needed
Prerequisites: Network access to the target phpCollab instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Sysdream · webappsphp
https://www.exploit-db.com/exploits/42934

This exploit demonstrates an unauthenticated arbitrary file upload vulnerability in PhpCollab 2.5.1, allowing an attacker to upload and execute malicious PHP files via a crafted HTTP POST request. The vulnerable code fails to properly filter file extensions, enabling remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: PhpCollab <= 2.5.1
No auth needed
Prerequisites: Network access to the target PhpCollab instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by jlk · poc
https://github.com/jlk/exploit-CVE-2017-6090

This repository provides a containerized environment for PhpCollab 2.5.1, which is vulnerable to CVE-2017-6090, a remote code execution vulnerability. It includes instructions for setting up the environment and exploiting the vulnerability using Metasploit.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PhpCollab 2.5.1
No auth needed
Prerequisites: Docker · Docker Compose · Metasploit
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/phpcollab_upload_exec.rb

This Metasploit module exploits an unauthenticated file upload vulnerability in phpCollab 2.5.1, allowing arbitrary PHP code execution via a malicious file upload to the 'logos_clients' directory.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: phpCollab 2.5.1
No auth needed
Prerequisites: Network access to the target · phpCollab 2.5.1 installation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

PhpColl 2.5.1 Arbitrary File Upload
HIGHby pikpikcu
Shodan: http.title:"PhpCollab" || http.title:"phpcollab"
FOFA: title="phpcollab"

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42934/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43519/

Scores

CVSS v3 8.8
EPSS 0.9600
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull jlkinsel/exploit-cve-2017-6090

Details

VulnCheck KEV 2024-01-04
CWE
CWE-434
Status published
Products (1)
phpcollab/phpcollab < 2.5.1
Published Oct 03, 2017
Tracked Since Feb 18, 2026