{"id":"CVE-2019-10945","aliases":["EUVD-2019-2659","GHSA-fg75-qw6g-52mj"],"status":"published","title":"An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly...","description":"An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.40275,"percentile":0.98651,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2019-04-10T18:07:28Z","modified":"2026-10-24T10:31:01Z","exploits":[{"source":"exploitdb","id":"EDB-46710","title":"Joomla! Core 1.5.0 - 3.9.4 - Directory Traversal / Authenticated Arbitrary File Deletion","type":"webapps","platform":"php","date":"2019-04-16","url":"https://www.exploit-db.com/exploits/46710"},{"source":"pocgithub","id":"Snizi/CVE-2019-10945","title":"Snizi/CVE-2019-10945","date":"2025-09-02","url":"https://github.com/Snizi/CVE-2019-10945"},{"source":"pocgithub","id":"dpgg101/CVE-2019-10945","title":"dpgg101/CVE-2019-10945","date":"2023-02-24","url":"https://github.com/dpgg101/CVE-2019-10945"},{"source":"pocgithub","id":"tayW84/CVE-2019-10945----Python3","title":"tayW84/CVE-2019-10945----Python3","date":"2026-03-19","url":"https://github.com/tayW84/CVE-2019-10945----Python3"}],"products":[{"vendor":"joomla","product":"joomla\\!"}],"references":[{"url":"https://developer.joomla.org/security-centre/777-20190401-core-directory-traversal-in-com-media","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/46710/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/152515/Joomla-3.9.4-Arbitrary-File-Deletion-Directory-Traversal.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10945"},{"url":"https://github.com/advisories/GHSA-fg75-qw6g-52mj"}],"sources":{"cve":[{"id":"CVE-2019-10945","description":"An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.","status":"published","published":"2019-04-10T18:07:28Z","modified":"2024-08-04T22:40:15.467Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-2659","description":"An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.","status":"published","published":"2019-04-10T18:07:28Z","modified":"2024-08-04T22:40:15Z","updated_at":"2026-11-03T02:40:50.763878Z"}],"ghsa":[{"id":"GHSA-fg75-qw6g-52mj","title":"An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly...","description":"An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.","status":"published","published":"2022-05-14T01:09:46Z","modified":"2023-02-02T05:03:21Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:51:37.12522Z"}],"nvd":[{"id":"CVE-2019-10945","description":"An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.","status":"published","published":"2019-04-10T19:29:00.727Z","modified":"2026-06-17T02:11:58.13Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"CVE-2019-10945","description":"An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.","status":"published","published":"2019-04-10T19:29:00.727Z","modified":"2026-10-24T10:31:01.196085563Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.383287Z"}]}}