Every CVE Search/ Get API key

CVE-2018-19422

Subrion CMS RCE Vulnerability

7.2 HighPublic exploitFix available

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

64.5%Up 64.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.2

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Record
CVE-2018-19422
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-434
Updated
2026-11-02
CVE List No score

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Record
CVE-2018-19422
Updated
2026-11-02
EUVDEUVD-2022-2907 No score

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Record
EUVD-2022-2907
Updated
2026-11-03
GitHub AdvisoriesGHSA-73xj-v6gc-g5p5 7.2

Subrion CMS RCE Vulnerability

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Record
GHSA-73xj-v6gc-g5p5
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02
OSV 7.2

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Record
CVE-2018-19422
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-73xj-v6gc-g5p5 7.2

Subrion CMS RCE Vulnerability

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Record
GHSA-73xj-v6gc-g5p5
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
intelliants/subrion
Packagist
 through 4.2.1
4.2.2
intelliants/subrion
Packagist
 before 4.2.2, plus listed versions
v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4
Show 9 moreShow less
v4.0.5v4.1.0v4.1.1v4.1.2v4.1.3v4.1.4v4.1.5v4.2.0v4.2.1
4.2.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBSubrion CMS 4.2.1 - Arbitrary File Upload2021-05-17
MetasploitIntelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE2018-11-04
PoC in GitHubDrew-Alleman/CVE-2018-194222025-04-04
PoC in GitHubSwammers8/SubrionCMS-4.2.1-File-upload-RCE-auth-2022-04-29
PoC in GitHubhev0x/CVE-2018-19422-SubrionCMS-RCE2021-06-14

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19422 is a high vulnerability (CVSS 7.2) in Intelliants Subrion Cms, published November 21, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 64.5%, the 99th percentile. Fixed in intelliants/subrion 4.2.2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open