FileThingie version 2.5.7 allows an attacker to upload a ZIP archive through the ft2.php endpoint. The archive may contain PHP code, which is extracted into a web-accessible directory and can be executed. This arbitrary file upload flaw (CWE-22) can lead to unauthorized code execution, compromising the confidentiality, integrity, and availability of the system.

The impact covers installations of FileThingie 2.5.7 that expose the ft2.php upload endpoint and enable ZIP extraction. Any deployment running this version is vulnerable, regardless of their server configuration.

The CVSS score of 9.3 indicates high severity, while the EPSS score is below 1% and the vulnerability does not appear in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST to the ft2.php endpoint, as inferred from the description. An attacker needs only the ability to send HTTP requests to the vulnerable endpoint; no authentication or elevated privileges are required. If the malicious PHP shell is successfully uploaded and executed, the attacker gains unrestricted code execution on the host.