High severity7.5NVD Advisory· Published Nov 21, 2019· Updated Jun 17, 2026
CVE-2019-10767
CVE-2019-10767
Description
An attacker can include file contents from outside the /adapter/xxx/ directory, where xxx is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. Note: The attacker has to be logged in if the authentication is enabled (by default isn't enabled).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
iobroker.js-controllernpm | < 2.0.25 | 2.0.25 |
Affected products
2- administrative web panel/administrative web paneldescription
Patches
Vulnerability mechanics
References
5- github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fdanvdPatchThird Party AdvisoryWEB
- snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-cmch-296j-wfvwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-10767ghsaADVISORY
- www.npmjs.com/advisories/1419ghsaWEB
News mentions
0No linked articles in our index yet.