CVE-2019-19731

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).

• CWE-22

• https://packetstormsecurity.com/files/155666/Roxy-Fileman-1.4.5-For-.NET-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://www.roxyfileman.com/downloadRelease Notes
• https://packetstormsecurity.com/files/155666/Roxy-Fileman-1.4.5-For-.NET-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://www.roxyfileman.com/downloadRelease Notes

Published

Dec 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19725sysstat through 12.2.0 has a double free in check_file_actls…9.8
• CVE-2019-19726OpenBSD through 6.6 allows local users to escalate to root b…7.8
• CVE-2019-19727SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has wea…5.5
• CVE-2019-19728SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 execute…7.5
• CVE-2019-19729An issue was discovered in the BSON ObjectID (aka bson-objec…7.5
• CVE-2019-1973A vulnerability in the web portal framework of Cisco Enterpr…4.8
• CVE-2019-19732translation_manage_text.ajax.php and various *_manage.ajax.p…7.2
• CVE-2019-19733_get_all_file_server_paths.ajax.php (aka get_all_file_server…6.1
• CVE-2019-19734_account_move_file_in_folder.ajax.php in MFScripts YetiShare…8.8
• CVE-2019-19735class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.…9.1
• CVE-2019-19736MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Htt…6.1
• CVE-2019-19737MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Sam…8.8