Critical severity9.8NVD Advisory· Published Dec 4, 2019· Updated Jun 26, 2026
CVE-2019-19576
CVE-2019-19576
Description
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
verot/class.upload.phpPackagist | < 1.0.3 | 1.0.3 |
verot/class.upload.phpPackagist | >= 2.0.0, < 2.0.4 | 2.0.4 |
Affected products
4- verot.net/class.uploaddescription
Patches
Vulnerability mechanics
References
12- github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124nvdPatchThird Party AdvisoryWEB
- github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1nvdPatchThird Party AdvisoryWEB
- github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2nvdPatchThird Party AdvisoryWEB
- github.com/verot/class.upload.php/compare/1.0.2...1.0.3nvdPatchThird Party AdvisoryWEB
- github.com/verot/class.upload.php/compare/2.0.3...2.0.4nvdPatchThird Party AdvisoryWEB
- packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-r5gm-4p5w-pq2pghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-19576ghsaADVISORY
- www.verot.net/php_class_upload.htmnvdVendor AdvisoryWEB
- medium.com/%40jra8908/cve-2019-19576-e9da712b779nvdWEB
- medium.com/@jra8908/cve-2019-19576-e9da712b779ghsaWEB
- www.verot.netnvdProductWEB
News mentions
0No linked articles in our index yet.