What’s Vulnerable › Vulnerabilities

CVE-2019-16216

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-18 · updated 2026-06-17
• Weakness: CWE-79

Description

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack is only effective against browsers lacking support for Content-Security-Policy such as Internet Explorer 11. On a Zulip server using the S3 uploads backend, the attack is confined to the origin of the configured S3 uploads hostname and cannot reach the Zulip server itself.

Affected products

• zulip: from 1.8.0 before 2.0.5 — fixed in 2.0.5

How to fix

Upgrade to a fixed version: zulip 2.0.5. Check the vendor advisory for mitigations.

References

• https://blog.zulip.org/2019/09/11/zulip-server-2-0-5-security-release/
• https://github.com/zulip/zulip/commit/1195841dfb9aa26b3b0dabc6f05d72e4af25be3e
• https://blog.zulip.org/2019/09/11/zulip-server-2-0-5-security-release/
• https://github.com/zulip/zulip/commit/1195841dfb9aa26b3b0dabc6f05d72e4af25be3e

Get alerted when CVE-2019-16216 or the next vulnerability affects your stack