CVE-2019-16986

Name: CVE-2019-16986
Creator: NVD / NIST
Published: 2019-10-21T16:15:18.133+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 1.41%

Last modified Jun 17, 2026

CVE-2019-16986 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.). EPSS estimates a 1.41% chance of exploitation in the next 30 days.

Description

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)

Metrics

CVSS 3.1

6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

1.41%

69.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-22

Affected Software

Vendor	Product	Versions
Fusionpbx	Fusionpbx	<= 4.5.7

References

https://github.com/fusionpbx/fusionpbx/commit/9482d9ee0e4287df21339be4276125e38e048951Not Applicable
https://github.com/fusionpbx/fusionpbx/commit/9c61191049c949e01f99ea1fbab1feb44709e108Not Applicable
https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-2/Third Party Advisory
https://github.com/fusionpbx/fusionpbx/commit/9482d9ee0e4287df21339be4276125e38e048951Not Applicable
https://github.com/fusionpbx/fusionpbx/commit/9c61191049c949e01f99ea1fbab1feb44709e108Not Applicable
https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-2/Third Party Advisory

Timeline

Published: Oct 21, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-16986?

How severe is CVE-2019-16986?

CVE-2019-16986 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 1.41% probability of exploitation in the next 30 days.

How do I fix CVE-2019-16986?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-16986?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST