What’s Vulnerable › Vulnerabilities

CVE-2019-19576

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 26.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-04 · updated 2026-06-26
• Weakness: CWE-434

Description

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Affected products

• getk2.org K2 extension for Joomla: through 2.10.1
• Verot Project Verot: before 1.0.3; from 2.0.0 before 2.0.4 — fixed in 1.0.3, 2.0.4

How to fix

Upgrade to a fixed version: Verot Project Verot 1.0.3, 2.0.4. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html
• https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124
• https://github.com/jra89/CVE-2019-19576
• https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1
• https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2
• https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3
• https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4
• https://medium.com/%40jra8908/cve-2019-19576-e9da712b779
• https://www.verot.net
• https://www.verot.net/php_class_upload.htm
• http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html
• https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124

Get alerted when CVE-2019-19576 or the next vulnerability affects your stack