Subrion CMS RCE Vulnerability

HIGH 7.2CVE-2018-19422 · GHSA-73xj-v6gc-g5p5 · Published 21/11/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
intelliants/subrion Packagist	`< 4.2.2`	`4.2.2`
subrion cms intelliants	`= 4.2.1`	No fix yet

Description

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

NVD description

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

References

nvd.nist.gov/vuln/detail/CVE-2018-19422 · ADVISORY
intelliants/subrion · WEB
intelliants/subrion commit 74359bc · WEB
packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html · WEB
packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free