Flatnux Authenticated File Upload Vulnerability Leading to Remote Code Execution

A file upload vulnerability allowing administrative users to upload arbitrary PHP files has been identified in Flatnux version 2021-03.25. This vulnerability arises from an unrestricted upload feature in the file manager, which can be exploited by admin users to upload malicious PHP scripts to the web root directory. Such actions could lead to remote code execution on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Flatnux 2021-03.25 is installed.

Reproduction

To reproduce this vulnerability, an authenticated administrative user can upload a PHP file through the file manager. The uploaded file will be placed in the web root directory, where it can be executed, leading to remote code execution on the server.