CVE-2019-19634
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk90th percentile - higher than 90% of all known CVEs
Summary
The vulnerability in class.upload.php (versions up to 1.0.3 and 2.x up to 2.0.4), used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, similar to CVE-2019-19576.
Risk Assessment
An attacker can upload a file with the .pht extension, which may be executed by the server, leading to remote code execution and compromise of the application.
Recommendation
Update class.upload to a version newer than 2.0.4 or apply a workaround by adding .pht to the list of forbidden extensions in the upload configuration.
Original NVD description (English source)
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.