CVE-2019-15716

PoC —

CVSS 3.0

5.5 medium

EPSS

<1%p38

Published

Aug 28, 2019 (Aug 28, 2019)

Modified

Jun 17, 2026

Description

WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.

Vendors: wtfutil
Products: wtf
Weakness: CWE-276
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.