CVE-2019-17199

7.5 highEPSS 10.0%

High (7.5) in webpagetest webpagetest. EPSS 10.0% chance of exploitation in the next 30 days.

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.jpg\.. substring.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 10.0% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-10-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

webpagetest:webpagetest

References

https://github.com/WPO-Foundation/webpagetest/pull/1299
https://github.com/WPO-Foundation/webpagetest/pull/1299

Check your stack JSON