UpHeron
All vulnerabilities

Servers and applications

CVE-2019-19745

Unrestricted file uploads

Severity
High 8.8
Published
17 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.4.46
Exploit chance
1.1% in the next 30 daysHigher than 66% of CVEs. EPSS by FIRST, 10 Nov 2026
Also known as
GHSA-wjx8-cgrm-hh8p
Sources
NVD, Project advisories (GitHub)

Description

A back end user with access to the form generator can upload arbitrary files and execute them on the server.

From contao/contao's security advisory.

Workarounds

Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.

Workarounds as given by contao/contao's security advisory.

Affected software

SoftwareAffected versions
ContaoServers and applications · cpe:a:contao:contao
  • From 4.8 up to 4.8.5
  • Version 4.7
  • Version 4.6
  • Version 4.5
All 9 release lines
  • Version 4.0
  • Version 4.1
  • Version 4.2
  • Version 4.3
  • From 4.4 up to 4.4.45
  • Version 4.5
  • Version 4.6
  • Version 4.7
  • From 4.8 up to 4.8.5
ContaoServers and applications · github:contao/contao
  • From 4.0.0 before 4.4.46

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-19745
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-19745
  • GitHub Advisory Database https://github.com/advisories/GHSA-wjx8-cgrm-hh8p
  • github.com https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p