---
id: CVE-2019-19634
title: >-
  class.upload.php in verot.net class.upload through 1.0.3 and 2.x through
  2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht
  from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
summary: >-
  class.upload.php in verot.net class.upload through 1.0.3 and 2.x through
  2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht
  from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
vendor: verot_project
product: verot
affected:
  - verot < 1.0.3
  - 'verot >= 2.0.0, < 2.0.4'
  - k2 <= 2.10.1
patched:
  - verot 2.0.4
published: '2019-12-17'
updated: '2026-06-26'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-19634'
references:
  - url: 'https://github.com/jra89/CVE-2019-19634'
    label: cve@mitre.org
  - url: >-
      https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068
    label: cve@mitre.org
  - url: >-
      https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
    label: cve@mitre.org
  - url: 'https://github.com/jra89/CVE-2019-19634'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.04187
epssPercentile: 0.9048
ingestedAt: '2026-06-26T16:43:13.358Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/jra89/CVE-2019-19634'
  checkedAt: '2026-09-23T07:13:15.845Z'
exploitAvailable: true
---

## Overview

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

## Affected

- `verot < 1.0.3`
- `verot >= 2.0.0, < 2.0.4`
- `k2 <= 2.10.1`

## Remediation

Upgrade past the affected range:

- `verot 2.0.4`