CVE-2019-16317

Published: 2019-09-14T18:15Z

Last Modified: 2024-11-21T04:30Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt