PT-2026-26927 · Unknown · Phptransformer

Ihsan Sencan · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2019-25579

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpTransformer version 2016.9

Description The software contains a directory traversal issue that allows attackers without authentication to access arbitrary files. This is achieved by manipulating the path parameter. Attackers can send requests to the jQueryFileUploadmaster server endpoint using traversal sequences like ../../../../../ to list and retrieve files outside the intended directory.

Recommendations Apply updates to address the issue in phpTransformer version 2016.9.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-25579

Produtos afetados

Phptransformer

Referências · 5

• 🔥 https://exploit-db.com/exploits/46192 · Exploit
• https://netcologne.dl.sourceforge.net/project/phptransformer/Version%202016.9/release_2016.9.zip · Nota
• https://vulncheck.com/advisories/phptransformer-directory-traversal-via-jqueryfileupload · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25579 · Nota de Segurança
• http://phptransformer.com · Nota