CVE-2019-10765
Arbitrary File Write in iobroker.admin
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the /log/file1/ directory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the /log/file1/ directory.
- Record
CVE-2019-10765- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the /log/file1/ directory.
- Record
CVE-2019-10765- Updated
- 2026-11-02
EUVDEUVD-2020-0769 No score
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the /log/file1/ directory.
- Record
EUVD-2020-0769- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-54xj-q58h-9x57
Arbitrary File Write in iobroker.admin
Versions of iobroker.admin prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in the /log/ route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.
Recommendation
Upgrade to version 3.6.12 or later.
- Record
GHSA-54xj-q58h-9x57- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the /log/file1/ directory.
- Record
CVE-2019-10765- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-54xj-q58h-9x57
Arbitrary File Write in iobroker.admin
Versions of iobroker.admin prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in the /log/ route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.
Recommendation
Upgrade to version 3.6.12 or later.
- Record
GHSA-54xj-q58h-9x57- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iobroker.adminnpm |
before 3.6.12 | 3.6.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10765 is a critical vulnerability (CVSS 9.8) in Iobroker Iobroker.admin, published November 20, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in iobroker.admin 3.6.12.