{"id":"CVE-2018-19422","aliases":["EUVD-2022-2907","GHSA-73xj-v6gc-g5p5"],"status":"published","title":"Subrion CMS RCE Vulnerability","description":"/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.64507,"percentile":0.99243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-434"],"published":"2018-11-21T00:00:00Z","modified":"2026-10-20T10:50:23Z","exploits":[{"source":"exploitdb","id":"EDB-49876","title":"Subrion CMS 4.2.1 - Arbitrary File Upload","type":"webapps","platform":"php","date":"2021-05-17","url":"https://www.exploit-db.com/exploits/49876"},{"source":"metasploit","id":"exploit/multi/http/subrion_cms_file_upload_rce","title":"Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE","type":"exploit","platform":"PHP","date":"2018-11-04","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/subrion_cms_file_upload_rce"},{"source":"pocgithub","id":"Drew-Alleman/CVE-2018-19422","title":"Drew-Alleman/CVE-2018-19422","date":"2025-04-04","url":"https://github.com/Drew-Alleman/CVE-2018-19422"},{"source":"pocgithub","id":"Swammers8/SubrionCMS-4.2.1-File-upload-RCE-auth-","title":"Swammers8/SubrionCMS-4.2.1-File-upload-RCE-auth-","date":"2022-04-29","url":"https://github.com/Swammers8/SubrionCMS-4.2.1-File-upload-RCE-auth-"},{"source":"pocgithub","id":"hev0x/CVE-2018-19422-SubrionCMS-RCE","title":"hev0x/CVE-2018-19422-SubrionCMS-RCE","date":"2021-06-14","url":"https://github.com/hev0x/CVE-2018-19422-SubrionCMS-RCE"}],"fixes":[{"ecosystem":"Packagist","package":"intelliants/subrion","fixed_in":["4.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"intelliants/subrion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.1"},{"fixed":"4.2.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"intelliants/subrion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2"}]}],"versions":["v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.1.0","v4.1.1","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.2.0","v4.2.1"]}],"products":[{"vendor":"intelliants","product":"subrion_cms"}],"references":[{"url":"https://github.com/intelliants/subrion/issues/801","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19422","tags":["advisory"]},{"url":"https://github.com/intelliants/subrion/commit/74359bcfaea424edda6d782a8ac25397c55972ab","tags":["web"]},{"url":"https://github.com/advisories/GHSA-73xj-v6gc-g5p5"}],"sources":{"cve":[{"id":"CVE-2018-19422","description":"/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.","status":"published","published":"2018-11-21T00:00:00Z","modified":"2024-08-05T11:37:11.273Z","updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2022-2907","description":"/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.","status":"published","published":"2018-11-21T00:00:00Z","modified":"2024-08-05T11:37:11Z","updated_at":"2026-11-03T02:39:32.93138Z"}],"ghsa":[{"id":"GHSA-73xj-v6gc-g5p5","title":"Subrion CMS RCE Vulnerability","description":"`/panel/uploads` in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.","status":"published","published":"2022-05-13T01:10:00Z","modified":"2023-08-29T19:32:42Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2018-19422","description":"/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.","status":"published","published":"2018-11-21T21:29:00.313Z","modified":"2026-06-17T01:49:16.973Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"CVE-2018-19422","description":"/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.","status":"published","published":"2018-11-21T21:29:00.313Z","modified":"2026-10-20T10:50:23.259278096Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"GHSA-73xj-v6gc-g5p5","title":"Subrion CMS RCE Vulnerability","description":"`/panel/uploads` in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.","status":"published","published":"2022-05-13T01:10:00Z","modified":"2024-02-16T08:17:23.422377Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}