CVE-2019-19634

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-17 · updated 2026-06-26
Weakness: CWE-434

Description

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Affected products

getk2.org K2 extension for Joomla: through 2.10.1
Verot Project Verot: before 1.0.3; from 2.0.0 before 2.0.4 — fixed in 1.0.3, 2.0.4

How to fix

Upgrade to a fixed version: Verot Project Verot 1.0.3, 2.0.4. Check the vendor advisory for mitigations.

References

https://github.com/jra89/CVE-2019-19634
https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068
https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
https://github.com/jra89/CVE-2019-19634
https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068
https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e

Get alerted when CVE-2019-19634 or the next vulnerability affects your stack