GitHub Advisoryadvisory · Packagist

GHSA-r5gm-4p5w-pq2p Remote code execution in verot/class.upload.php

CRITICAL Published 2020-01-16 Modified 2026-07-21 Official page ↗
Aliases
CVE-2019-19576
Ecosystem
Packagist
Packages
verot/class.upload.php
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2020-01-16

Affected packages

• Packagist verot/class.upload.php: < 1.0.3 → fixed in 1.0.3 • Packagist verot/class.upload.php: >= 2.0.0, < 2.0.4 → fixed in 2.0.4

Description

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Related

Alias · CVE (1)

  • CVE-2019-19576 class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References