CVE-2019-19576

CriticalCVSS 9.8/10Last modified Jun 26, 2026

Description

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124Patch, Third Party Advisory
https://github.com/jra89/CVE-2019-19576Exploit, Third Party Advisory
https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1Patch, Third Party Advisory
https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2Patch, Third Party Advisory
https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3Patch, Third Party Advisory
https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4Patch, Third Party Advisory
https://medium.com/%40jra8908/cve-2019-19576-e9da712b779
https://www.verot.netProduct
https://www.verot.net/php_class_upload.htmVendor Advisory
http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124Patch, Third Party Advisory
https://github.com/jra89/CVE-2019-19576Exploit, Third Party Advisory
https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1Patch, Third Party Advisory
https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2Patch, Third Party Advisory
https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3Patch, Third Party Advisory
https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4Patch, Third Party Advisory
https://medium.com/%40jra8908/cve-2019-19576-e9da712b779
https://www.verot.netProduct
https://www.verot.net/php_class_upload.htmVendor Advisory

Timeline

Published: Dec 4, 2019
Last modified: Jun 26, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-195777.2An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges b CVE-2019-195788.8An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pa CVE-2019-195796.8An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain CVE-2019-19588.8A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct CVE-2019-195806.6An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pag CVE-2019-195816.5An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because CVE-2019-195826.5An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit i CVE-2019-195837.5An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX CVE-2019-195857.8An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig spe CVE-2019-195876.1In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Mana CVE-2019-195887.5The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain strin CVE-2019-195899.8The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: