CVE-2019-10719

8.8 highEPSS 7.5%

High (8.8) in dotnetblogengine blogengine.net. EPSS 7.5% chance of exploitation in the next 30 days.

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.5% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-06-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dotnetblogengine:blogengine.net

References

http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2019/Jun/26
https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720
http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2019/Jun/26

Check your stack JSON