CVE-2019-19848

—

CVSS 3.1

7.2 high

EPSS

1%p72

Published

Dec 17, 2019 (Dec 17, 2019)

Modified

Jun 17, 2026

Description

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)

Vendors: typo3
Products: typo3
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.