Hello

[NicolasCARPi]

Hello,

I'm the dev of elabftw.

One should note that version 1.8.5 is an old version (we are at version 3.2.0 soon), and softaculous is really not the best hoster. First, they are stuck with 1.8.5, second, they don't configure their website properly: normally .php5 files should not be executed by php, but I guess that's softaculous's config that is like this. Because .php files cannot be uploaded. Also, uploads folder should not be accessible directly.

Furthermore, now the uploads folder is out of the webroot.

To finish, I appreciate that you guys/gals are trying to find vulnerabilities in my software, and I would appreciate more if you can contact me by email if you find one before disclosing it. ;)

Cheers,
~Nico