CVE-2019-19576
CVE-2019-19576
This page contains facts from public vulnerability sources. Check the original advisory before updating.
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
CVSS 9.8 · Critical · EPSS 26.4% · Public exploit · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
verot/class.upload.php Packagist
- Versions
- 1.0.0
- 1.0.1
- 1.0.2
- Affected ranges
- ECOSYSTEM: < 1.0.3
Update to 1.0.3
verot/class.upload.php Packagist
- Versions
- 2.0.0
- 2.0.1
- 2.0.2
- 2.0.3
- Affected ranges
- ECOSYSTEM: ≥ 2.0.0, < 2.0.4
Update to 2.0.4
Original sources
- https://www.verot.net/php_class_upload.htm
- https://www.verot.net
- https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4
- https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1
- https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3
- https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2
- https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124
- https://github.com/jra89/CVE-2019-19576
- https://medium.com/%40jra8908/cve-2019-19576-e9da712b779
- http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19576