CVE-2015-0258: 
Linux Debian vulnerability analysis and mitigation

Multiple incomplete blacklist vulnerabilities were discovered in the avatar upload functionality in manageuser.php in Collabtive before version 2.1. This vulnerability was assigned CVE-2015-0258 and was publicly disclosed in February 2020 (NVD).

The vulnerability exists due to insufficient validation of file extensions during avatar uploads. The system implements an incomplete blacklist that fails to properly filter certain PHP file extensions, specifically .php3, .php4, .php5, and .phtml. The vulnerability has a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

If exploited, this vulnerability allows remote authenticated users to execute arbitrary code on the affected server by uploading files with specific PHP extensions that bypass the security filters (NVD).

The vulnerability was patched in Collabtive version 2.1 by improving the file extension filtering mechanism. For affected systems, updates are available through various distribution channels. Ubuntu 16.04 ESM users should upgrade to version 2.0+dfsg-6ubuntu1.1, while Debian 8 'Jessie' users should upgrade to version 2.0+dfsg-5+deb8u1 (Ubuntu Notice, Debian Notice).