p PatchFirst

CVE-2019-10874

CVE-2019-10874

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.

CVSS 8.8 · High · EPSS 4.5% · Public exploit · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • bolt/bolt Packagist

    Versions
    • 3.6.6
    • v3.6.6
    Affected ranges
    • ECOSYSTEM: ≥ 3.6.6, < 3.6.7

    Update to 3.6.7

Original sources

Check your server →