CVE-2019-15862

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the application was configured to accept files only with a defined set of extensions). This affects CKFinder for ASP, CKFinder for ASP.NET, CKFinder for ColdFusion, and CKFinder for PHP.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://ckeditor.com/blog/CKFinder-3.5.1-and-CKFinder-2.6.3-released/Third Party Advisory
https://ckeditor.com/blog/CKFinder-3.5.1-and-CKFinder-2.6.3-released/Third Party Advisory

Timeline

Published: Sep 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-158637.5The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.CVE-2019-158646.1The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.CVE-2019-158658.8The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.CVE-2019-158668.8The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_im CVE-2019-158678.8The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca CVE-2019-158688.8The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.CVE-2019-158695.4The JobCareer theme before 2.5.1 for WordPress has stored XSS.CVE-2019-15874.3A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, re CVE-2019-158705.4The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.CVE-2019-158714.3The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-158729.8The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-158738.8The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.