CVE-2014-5298
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file...
CVE-2014-5298 is a medium vulnerability (CVSS 5.0) in X2engine, published October 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.00%, the 87th percentile. No source names a fixed version.
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program.
Exploit likelihood
What each source reports
NVD Score used
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program.
- Record
CVE-2014-5298- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program.
- Record
CVE-2014-5298- Updated
- 2026-11-02
EUVDEUVD-2014-5189 No score
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program.
- Record
EUVD-2014-5189- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jfm-3q68-9546 No score
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file...
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program.
- Record
GHSA-8jfm-3q68-9546- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
packetstormsecurity.com/files/128353/X2Engine-4.1.7-Unrestricted-File-Upload.html
seclists.org/fulldisclosure/2014/Sep/78
securityfocus.com/archive/1/533514/100/0/threaded
karmainsecurity.com/KIS-2014-10
github.com/X2Engine/X2Engine/blob/master/CHANGELOG.md
cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf
nvd.nist.gov/vuln/detail/CVE-2014-5298