CVE-2019-19576

CriticalCVSS 9.8

Published: 04/12/2019(UTC)Updated: 26/06/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

26.18%

98th percentile - higher than 98% of all known CVEs

Summary

Vulnerability in class.upload.php (versions before 1.0.3 and 2.x before 2.0.4) omits .phar from the list of dangerous file extensions. This library is used in the K2 extension for Joomla! and other products.

Risk Assessment

An attacker can upload a .phar file that may be executed on the server, leading to remote code execution (RCE) and full system compromise.

Recommendation

Update the class.upload library to version 1.0.3 or 2.0.4 (or later) and ensure that the K2 extension and other products using this library are up to date.

Original NVD description (English source)

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.