CVE-2019-19634
1 advisory.
Packagist/verot/class.upload.php CVE-2019-19634: critical 9.8, EPSS 4.19%
class.upload.php in verot.net omits .pht from the set of dangerous file extensions
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.0.3 |
| 2.0.0 | - | 2.0.4 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-2gc7-w4hw-rr2m
- https://nvd.nist.gov/vuln/detail/CVE-2019-19634
- https://github.com/jra89/CVE-2019-19634
- https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068
- https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
- https://medium.com/@jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
CVE-2019-19634 · published · modified · JSON