GHSA-2gc7-w4hw-rr2m
class.upload.php in verot.net omits .pht from the set of dangerous file extensions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | verot/class.upload.php | <= 1.0.3 | no fix listed |
| Packagist | verot/class.upload.php | >= 2.0.0, <= 2.0.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-19634
- https://github.com/jra89/CVE-2019-19634
- https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068
- https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
- https://medium.com/@jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e