CVE-2019-17352

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.

• CWE-434

• https://gitee.com/jfinal/cos/commit/5eb23d6e384abaad19faa7600d14c9a2f525946aPermissions Required, Vendor Advisory
• https://gitee.com/jfinal/cos/commit/8d26eec61f0d072a68bf7393cf3a8544a1112130Permissions Required, Vendor Advisory
• https://github.com/jfinal/jfinal/issues/171Exploit, Third Party Advisory
• https://gitee.com/jfinal/cos/commit/5eb23d6e384abaad19faa7600d14c9a2f525946aPermissions Required, Vendor Advisory
• https://gitee.com/jfinal/cos/commit/8d26eec61f0d072a68bf7393cf3a8544a1112130Permissions Required, Vendor Advisory
• https://github.com/jfinal/jfinal/issues/171Exploit, Third Party Advisory

Published

Oct 8, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17347An issue was discovered in Xen through 4.11.x allowing x86 P…7.8
• CVE-2019-17348An issue was discovered in Xen through 4.11.x allowing x86 P…6.5
• CVE-2019-17349An issue was discovered in Xen through 4.12.x allowing Arm d…5.5
• CVE-2019-1735A vulnerability in the CLI of Cisco NX-OS Software could all…7.8
• CVE-2019-17350An issue was discovered in Xen through 4.12.x allowing Arm d…5.5
• CVE-2019-17351An issue was discovered in drivers/xen/balloon.c in the Linu…6.5
• CVE-2019-17353An issue discovered on D-Link DIR-615 devices with firmware …8.2
• CVE-2019-17354wan.htm page on Zyxel NBG-418N v2 with firmware version V1.0…9.4
• CVE-2019-17355In the Orbitz application 19.31.1 for Android, the username …9.8
• CVE-2019-17356The Infinite Design application 3.4.12 for Android sends a u…6.5
• CVE-2019-17357Cacti through 1.2.7 is affected by a graphs.php?template_id=…6.5
• CVE-2019-17358Cacti through 1.2.7 is affected by multiple instances of lib…8.1