CVE-2019-16986

—

CVSS 3.1

6.5 medium

EPSS

1%p71

Published

Oct 21, 2019 (Oct 21, 2019)

Modified

Jun 17, 2026

Description

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)

Vendors: fusionpbx
Products: fusionpbx
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.