Authenticated File Upload Flaws Expose PhreeBooks ERP and phpBB to RCE
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 24, 2026
High-severity vulnerabilities have been disclosed for PhreeBooks ERP 5.2.3 and phpBB, both allowing authenticated attackers to turn file upload functionality into remote code execution. In CVE-2019-25630, an attacker can abuse the imgFile parameter in the bizuno/image/manager endpoint to upload a malicious PHP file and then execute it through bizunoFS.php. The issue affects the Image Manager component in PhreeBooks ERP and was rated high impact under both CVSS v3.1 and v4.0.
A separate flaw, CVE-2019-25685, affects phpBB and uses plupload together with the phar:// stream wrapper to upload a crafted ZIP archive containing serialized PHP objects. When those objects are later deserialized via the imagick parameter in attachment settings, arbitrary code can be executed on the server. References tied to the disclosures include Exploit-DB and VulnCheck, indicating public technical detail is available for both upload-to-RCE attack paths.
