CVE-2019-10719

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-21 · updated 2026-06-17
Weakness: CWE-22

Description

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.

Affected products

Dotnetblogengine Blogengine.Net: through 3.3.7.0

References

http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2019/Jun/26
https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720
http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2019/Jun/26
https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720

Get alerted when CVE-2019-10719 or the next vulnerability affects your stack