Remote code execution in verot/class.upload.php

Published Jan 16, 2020·Updated Jul 21, 2026

NVD Description

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Affected Packages (1)

verot/class.upload.phpCOMPOSER

Fixed in 1.0.3

Public Exploits & PoCs1 found

PoC: CVE-2019-19576

This is a filter bypass exploit that results in arbitrary file upload and remote code execution in class.upload.php <= 2.0.3

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free