{"id":"CVE-2019-13343","aliases":["EUVD-2019-4847","GHSA-pqrm-j279-r6cg"],"status":"published","title":"Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre...","description":"Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...\u0026h= substring followed by a filename.","severity":{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AC:L/AV:N/A:L/C:H/I:L/PR:N/S:C/UI:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02248,"percentile":0.83019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2019-10-02T15:49:29Z","modified":"2026-10-20T13:54:44Z","products":[{"vendor":"butor","product":"portal"}],"references":[{"url":"https://bitbucket.org/account/user/butor-team/projects/PROJ","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bitbucket.org/butor-team/portal/commits/cd7055d33e194fcf530100ee1d8d13aa9cde230b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bitbucket.org/butor-team/portal/src/cd7055d33e194fcf530100ee1d8d13aa9cde230b/src/main/java/com/butor/portal/web/servlet/WhiteLabelingServlet.java?at=master","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.gosecure.net/blog/2019/09/30/butor-portal-arbitrary-file-download-vulnerability-cve-2019-13343","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://bitbucket.org/butor-team/portal/commits/all","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13343"},{"url":"https://github.com/advisories/GHSA-pqrm-j279-r6cg"}],"sources":{"cve":[{"id":"CVE-2019-13343","description":"Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...\u0026h= substring followed by a filename.","status":"published","published":"2019-10-02T15:49:29Z","modified":"2024-08-04T23:49:24.668Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AC:L/AV:N/A:L/C:H/I:L/PR:N/S:C/UI:N","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-4847","description":"Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...\u0026h= substring followed by a filename.","status":"published","published":"2019-10-02T15:49:29Z","modified":"2024-08-04T23:49:24Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AC:L/AV:N/A:L/C:H/I:L/PR:N/S:C/UI:N","level":"critical"}],"updated_at":"2026-11-03T02:40:42.893368Z"}],"ghsa":[{"id":"GHSA-pqrm-j279-r6cg","title":"Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre...","description":"Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...\u0026h= substring followed by a filename.","status":"published","published":"2022-05-24T16:57:40Z","modified":"2024-04-04T02:07:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:56:06.631442Z"}],"nvd":[{"id":"CVE-2019-13343","description":"Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...\u0026h= substring followed by a filename.","status":"published","published":"2019-10-02T16:15:14.227Z","modified":"2026-06-17T02:16:36.513Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"critical","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:31.019577Z"}],"osv":[{"id":"CVE-2019-13343","description":"Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...\u0026h= substring followed by a filename.","status":"published","published":"2019-10-02T16:15:14.227Z","modified":"2026-10-20T13:54:44.014197986Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"}]}}