PT-2026-26927 · Unknown · Phptransformer

Ihsan Sencan · Published 2026-03-21 · Updated 2026-03-21 · CVE-2019-25579

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpTransformer version 2016.9

Description The software contains a directory traversal issue that allows attackers without authentication to access arbitrary files. This is achieved by manipulating the path parameter. Attackers can send requests to the jQueryFileUploadmaster server endpoint using traversal sequences like ../../../../../ to list and retrieve files outside the intended directory.

Recommendations Apply updates to address the issue in phpTransformer version 2016.9.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-25579

Affected Products

Phptransformer

References · 5

• 🔥 https://exploit-db.com/exploits/46192 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25579 · Security Note
• https://netcologne.dl.sourceforge.net/project/phptransformer/Version%202016.9/release_2016.9.zip · Note
• https://vulncheck.com/advisories/phptransformer-directory-traversal-via-jqueryfileupload · Note
• http://phptransformer.com · Note