CVE-2019-16915

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a basename call) for a pathname to file_get_contents or file_put_contents.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/pfsense/pfsense/commit/2c544ac61ce98f716d50b8e5961d7dfba66804b5Patch, Third Party Advisory
https://redmine.pfsense.org/issues/9610Permissions Required, Third Party Advisory
https://www.seebug.org/vuldb/ssvid-98024Third Party Advisory
https://github.com/pfsense/pfsense/commit/2c544ac61ce98f716d50b8e5961d7dfba66804b5Patch, Third Party Advisory
https://redmine.pfsense.org/issues/9610Permissions Required, Third Party Advisory
https://www.seebug.org/vuldb/ssvid-98024Third Party Advisory

Timeline

Published: Sep 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-169178.8WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevi CVE-2019-169197.5Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robo CVE-2019-16925.3A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an u CVE-2019-169209.8Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the CVE-2019-169217.5In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data stru CVE-2019-169225.3SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files.CVE-2019-169236.1kkcms 1.3 has jx.php?url= XSS.CVE-2019-169248.8The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers (after sniffing the CVE-2019-169256.1Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vuln CVE-2019-169266.1Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker CVE-2019-169275.5Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc, a different vulnerab CVE-2019-169289.8Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow