Bolt Unrestricted Upload of File with Dangerous Type

높음 8.8CVE-2019-9185 · GHSA-gmg5-f2gm-p3h7 · Published 07/03/2019 · updated 17/06/2026

요약

CVE-2019-9185은(는) bolt/bolt, bolt (boltcms)에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.7%, 전체 취약점의 85.7%보다 높음.
조치: 3.6.5 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
bolt/bolt Packagist	`< 3.6.5`	`3.6.5`
bolt boltcms	`< 3.6.5`	`3.6.5`

Description

Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension.

NVD description

Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension.

References

nvd.nist.gov/vuln/detail/CVE-2019-9185 · ADVISORY
bolt/bolt#7745 · WEB
bolt/bolt · PACKAGE
bolt/bolt · WEB
bolt/bolt release v3.6.5 · WEB
hacksecproject.com · WEB

bolt/bolt의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

bolt/bolt

Packagist

< 3.6.5

3.6.5

bolt

boltcms

< 3.6.5

3.6.5

Description

NVD description

Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension.

bolt/bolt의 다른 취약점

모두 보기 →