CRITICAL 9.8

GHSA-2gc7-w4hw-rr2m

class.upload.php in verot.net omits .pht from the set of dangerous file extensions

Details

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist / verot/class.upload.php

Introduced in: 0

No fixed version published yet for verot/class.upload.php (composer). Pin to a known-safe version or switch to an alternative.

Packagist / verot/class.upload.php

Introduced in: 2.0.0

No fixed version published yet for verot/class.upload.php (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-19634 [ADVISORY]
https://github.com/jra89/CVE-2019-19634 [WEB]
https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068 [WEB]
https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e [WEB]
https://medium.com/@jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e [WEB]