CVE-2019-25579
Directory Traversal in phpTransformer 2016.9 Allows Arbitrary File Access
Publication date: 2026-03-21
Last updated on: 2026-03-23
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codnloc | phptransformer | 2016.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2019-25579 is a directory traversal vulnerability in phpTransformer version 2016.9 and earlier. It allows unauthenticated attackers to manipulate the "path" parameter in requests to the jQueryFileUploadmaster server endpoint to access files outside the intended directory.'}, {'type': 'paragraph', 'content': 'By injecting traversal sequences such as "../../../../../../", attackers can navigate upwards in the directory structure and list or retrieve arbitrary files on the server that should normally be restricted.'}, {'type': 'paragraph', 'content': 'This vulnerability requires no authentication, privileges, or user interaction, making it highly exploitable remotely over the network.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow attackers to access sensitive files on the server, such as configuration files, source code, or other protected data.
Unauthorized access to these files can lead to information disclosure, which may facilitate further attacks or compromise the security of the affected system.
Because the vulnerability requires no authentication or user interaction, it can be exploited remotely and easily, increasing the risk and potential impact.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending specially crafted HTTP requests to the vulnerable phpTransformer server endpoint and observing if directory traversal is possible.'}, {'type': 'paragraph', 'content': 'A typical detection method is to send a request to the jQueryFileUploadmaster server endpoint with the path parameter containing traversal sequences such as ../../../../../../ to see if files outside the intended directory are listed or retrieved.'}, {'type': 'paragraph', 'content': 'For example, you can use the following curl command to test for the vulnerability:'}, {'type': 'list_item', 'content': 'curl -v "http://[HOST]/Programs/gallery/admin/jQueryFileUploadmaster/server/php/index.php?path=../../../../../../"'}, {'type': 'paragraph', 'content': 'If the server responds with a JSON listing of files outside the intended directory, this confirms the presence of the directory traversal vulnerability.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
I don't know