class.upload.php in verot.net omits .pht from the set of dangerous file extensions

Published Feb 28, 2020·Updated Jul 21, 2026

NVD Description

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Affected Packages (1)

verot/class.upload.phpCOMPOSER

Fixed in = 1.0.3

Public Exploits & PoCs1 found

PoC: CVE-2019-19634

This is a filter bypass exploit that results in arbitrary file upload and remote code execution in class.upload.php <= 2.0.4

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free