CVE-2017-6090: Phpcollab

High severity, CVSS 8.8. EPSS: 96.4% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/.

Affected products

• Phpcollab Phpcollab: up to and including 2.5.1

Published 2017-10-03. Last modified 2026-06-17.