CVE-2019-19731 - CVE House
Back to Database
Status published High CVE-2019-19731

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal....

Vulnerability Description

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-19731

Credits & Attribution

No credits recorded in the NVD database.

References

More from roxyfileman

View All →
CVE-2022-40797
Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar...
Unknown 0
CVE-2019-7174
Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename...
Critical 9.8
CVE-2018-20526
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php....
Critical 9.8
CVE-2018-20525
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and...
Critical 9.1
CVE-2018-12042
Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php...
High 7.5

Affected Vendor

roxyfileman

View all reports →

Affected Software

roxy fileman
Vulnerable Versions:
1.4.5

Timeline

Official Publish: December 16th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.