CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed.

• CWE-552

• https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/Exploit, Third Party Advisory
• https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/Exploit, Third Party Advisory

Published

Nov 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17216An issue was discovered on V-Zug Combi-Steam MSLQ devices be…9.8
• CVE-2019-17217An issue was discovered on V-Zug Combi-Steam MSLQ devices be…8.8
• CVE-2019-17218An issue was discovered on V-Zug Combi-Steam MSLQ devices be…9.1
• CVE-2019-17219An issue was discovered on V-Zug Combi-Steam MSLQ devices be…8.8
• CVE-2019-1722A vulnerability in the FindMe feature of Cisco Expressway Se…6.5
• CVE-2019-17220Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] …6.1
• CVE-2019-17222An issue was discovered on Intelbras WRN 150 1.0.17 devices.…6.1
• CVE-2019-17223There is HTML Injection in the Note field in Dolibarr ERP/CR…6.1
• CVE-2019-17224The web interface of the Compal Broadband CH7465LG modem (ve…5.3
• CVE-2019-17225Subrion 4.2.1 allows XSS via the panel/members/ Username, Fu…5.4
• CVE-2019-17226CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin…4.8
• CVE-2019-17228includes/options.php in the motors-car-dealership-classified…6.5