{"id":"CVE-2019-16113","aliases":["EUVD-2019-6954","GHSA-ch69-hjrw-4hf3"],"status":"published","title":"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code...","description":"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.78109,"percentile":0.99579,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-94"],"published":"2019-09-08T20:50:28Z","modified":"2026-10-20T10:52:25Z","exploits":[{"source":"exploitdb","id":"EDB-47699","title":"Bludit - Directory Traversal Image File Upload (Metasploit)","type":"remote","platform":"php","date":"2019-11-20","verified":true,"url":"https://www.exploit-db.com/exploits/47699"},{"source":"exploitdb","id":"EDB-48568","title":"Bludit 3.9.12 - Directory Traversal","type":"webapps","platform":"php","date":"2020-06-09","url":"https://www.exploit-db.com/exploits/48568"},{"source":"exploitdb","id":"EDB-48701","title":"Bludit 3.9.2 - Directory Traversal","type":"webapps","platform":"multiple","date":"2020-07-26","url":"https://www.exploit-db.com/exploits/48701"},{"source":"metasploit","id":"exploit/linux/http/bludit_upload_images_exec","title":"Bludit Directory Traversal Image File Upload Vulnerability","type":"exploit","platform":"PHP","date":"2019-09-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/bludit_upload_images_exec"},{"source":"pocgithub","id":"DXY0411/CVE-2019-16113","title":"DXY0411/CVE-2019-16113","date":"2021-02-05","url":"https://github.com/DXY0411/CVE-2019-16113"},{"source":"pocgithub","id":"Kenun99/CVE-2019-16113-Dockerfile","title":"Kenun99/CVE-2019-16113-Dockerfile","date":"2020-07-03","url":"https://github.com/Kenun99/CVE-2019-16113-Dockerfile"},{"source":"pocgithub","id":"cybervaca/CVE-2019-16113","title":"cybervaca/CVE-2019-16113","date":"2020-06-04","url":"https://github.com/cybervaca/CVE-2019-16113"},{"source":"pocgithub","id":"dldygnl/CVE-2019-16113","title":"dldygnl/CVE-2019-16113","date":"2020-07-17","url":"https://github.com/dldygnl/CVE-2019-16113"},{"source":"pocgithub","id":"hg8/CVE-2019-16113-PoC","title":"hg8/CVE-2019-16113-PoC","date":"2020-06-09","url":"https://github.com/hg8/CVE-2019-16113-PoC"},{"source":"pocgithub","id":"m4rm0k/CVE-2019-16113","title":"m4rm0k/CVE-2019-16113","date":"2020-10-07","url":"https://github.com/m4rm0k/CVE-2019-16113"},{"source":"pocgithub","id":"mind2hex/CVE-2019-16113-Bludit-3.9.2-RCE","title":"mind2hex/CVE-2019-16113-Bludit-3.9.2-RCE","date":"2024-03-28","url":"https://github.com/mind2hex/CVE-2019-16113-Bludit-3.9.2-RCE"},{"source":"pocgithub","id":"ynots0ups/CVE-2019-16113","title":"ynots0ups/CVE-2019-16113","date":"2020-06-03","url":"https://github.com/ynots0ups/CVE-2019-16113"}],"products":[{"vendor":"bludit","product":"bludit"}],"references":[{"url":"https://github.com/bludit/bludit/issues/1081","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/155295/Bludit-Directory-Traversal-Image-File-Upload.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/157988/Bludit-3.9.12-Directory-Traversal.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/158569/Bludit-3.9.2-Directory-Traversal.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16113"},{"url":"https://github.com/advisories/GHSA-ch69-hjrw-4hf3"}],"sources":{"cve":[{"id":"CVE-2019-16113","description":"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.","status":"published","published":"2019-09-08T20:50:28Z","modified":"2024-08-05T01:03:32.768Z","updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2019-6954","description":"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.","status":"published","published":"2019-09-08T20:50:28Z","modified":"2024-08-05T01:03:32Z","updated_at":"2026-11-03T02:40:34.136734Z"}],"ghsa":[{"id":"GHSA-ch69-hjrw-4hf3","title":"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code...","description":"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.","status":"published","published":"2022-05-24T22:00:27Z","modified":"2024-04-04T03:06:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-94"],"updated_at":"2026-11-02T14:56:13.784244Z"}],"nvd":[{"id":"CVE-2019-16113","description":"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.","status":"published","published":"2019-09-08T21:15:10.617Z","modified":"2026-06-17T02:21:41.86Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:25.691233Z"}],"osv":[{"id":"CVE-2019-16113","description":"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.","status":"published","published":"2019-09-08T21:15:10.617Z","modified":"2026-10-20T10:52:25.088746022Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.361782Z"}]}}