CVE-2019-19731

7.5 highEPSS 12%

High (7.5) in roxyfileman roxy fileman. EPSS 12% chance of exploitation in the next 30 days.

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-12-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

roxyfileman:roxy_fileman

References

http://packetstormsecurity.com/files/155666/Roxy-Fileman-1.4.5-For-.NET-Directory-Traversal.html
http://www.roxyfileman.com/download
http://packetstormsecurity.com/files/155666/Roxy-Fileman-1.4.5-For-.NET-Directory-Traversal.html
http://www.roxyfileman.com/download

Check your stack JSON