Medium severity5.3NVD Advisory· Published Jul 26, 2019· Updated Jun 17, 2026

CVE-2019-14280

Description

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Craftcms/Craft CMS
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
Range: >=2.0.2524,<2.7.10
Craft/Craftdescription
Craftcms/CMSllm-fuzzy
Range: <2.7.10, <3.2.6

Patches

Vulnerability mechanics

References

github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.mdnvdRelease NotesThird Party Advisory
github.com/craftcms/cms/blob/develop/CHANGELOG-v3.mdnvdRelease NotesThird Party Advisory
packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.007
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000