CVE-2019-14924

HIGH 7.5CVE-2019-14924 · Published 10/08/2019 · updated 17/06/2026

In short

CVE-2019-14924 is a HIGH (CVSS 7.5) vulnerability affecting gcdwebserver (gcdwebserver project).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.2% of all vulnerabilities.
Fix: update to 3.5.3 or later.

Package	Affected versions	Patched versions
gcdwebserver gcdwebserver_project	`< 3.5.3`	`3.5.3`

Description

An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).

References

swisspol/GCDWebServer commit 0273843 · Patch
swisspol/GCDWebServer · Patch
swisspol/GCDWebServer · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free