CVE-2019-19634

Description

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

References

https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e

https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068

https://github.com/jra89/CVE-2019-19634

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS