GitHub Advisoryadvisory · Packagist

GHSA-2gc7-w4hw-rr2m class.upload.php in verot.net omits .pht from the set of dangerous file extensions

CRITICAL Published 2020-02-28 Modified 2026-07-21 Official page ↗
Aliases
CVE-2019-19634
Ecosystem
Packagist
Packages
verot/class.upload.php
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2020-02-25

Affected packages

• Packagist verot/class.upload.php: <= 1.0.3 (no fix yet) • Packagist verot/class.upload.php: >= 2.0.0, <= 2.0.4 (no fix yet)

Description

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Related

Alias · CVE (1)

  • CVE-2019-19634 class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References