CVE-2018-17139: Ultimatefosters Ultimatepos

High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days.

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type.

Affected products

• Ultimatefosters Ultimatepos: version 2.5 only

Published 2018-09-17. Last modified 2026-06-17.