{"id":"CVE-2019-19634","title":"class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.","summary":"class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"vendor":"verot_project","product":"verot","affected":["verot < 1.0.3","verot >= 2.0.0, < 2.0.4","k2 <= 2.10.1"],"patched":["verot 2.0.4"],"published":"2019-12-17","updated":"2026-06-26","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-19634","references":[{"url":"https://github.com/jra89/CVE-2019-19634","label":"cve@mitre.org"},{"url":"https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068","label":"cve@mitre.org"},{"url":"https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e","label":"cve@mitre.org"},{"url":"https://github.com/jra89/CVE-2019-19634","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.04187,"epssPercentile":0.9048,"ingestedAt":"2026-06-26T16:43:13.358Z","exploits":{"github":1,"githubRepos":["https://github.com/jra89/CVE-2019-19634"],"checkedAt":"2026-09-23T07:13:15.845Z"},"exploitAvailable":true,"slug":"CVE-2019-19634","body":"## Overview\n\nclass.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.\n\n## Affected\n\n- `verot < 1.0.3`\n- `verot >= 2.0.0, < 2.0.4`\n- `k2 <= 2.10.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `verot 2.0.4`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":53.9,"likelihood":0.8,"exploitation":12,"ransomware":0},"changes":[{"seq":4459,"id":"CVE-2019-19634","ts":1788887181281,"field":"exploit_available","old":"false","new":"true"},{"seq":3342,"id":"CVE-2019-19634","ts":1788886300207,"field":"exploit_available","old":"true","new":"false"},{"seq":2197,"id":"CVE-2019-19634","ts":1788882969885,"field":"exploit_available","old":"false","new":"true"},{"seq":1226,"id":"CVE-2019-19634","ts":1788882380227,"field":"exploit_available","old":"true","new":"false"},{"seq":340,"id":"CVE-2019-19634","ts":1788881816486,"field":"exploit_available","old":"false","new":"true"}]}