CVE-2019-19848

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)

• CWE-22

• https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:securityVendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2019-024/Vendor Advisory
• https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:securityVendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2019-024/Vendor Advisory

Published

Dec 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19842emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 al…9.8
• CVE-2019-19843Incorrect access control in the web interface in Ruckus Wire…9.8
• CVE-2019-19844Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.…9.8
• CVE-2019-19845In Joomla! before 3.9.14, a missing access check in framewor…5.3
• CVE-2019-19846In Joomla! before 3.9.14, the lack of validation of configur…9.8
• CVE-2019-19847Libspiro through 20190731 has a stack-based buffer overflow …8.1
• CVE-2019-19849An issue was discovered in TYPO3 before 8.7.30, 9.x before 9…8.8
• CVE-2019-1985In findAvailSpellCheckerLocked of TextServicesManagerService…
• CVE-2019-19850An issue was discovered in TYPO3 before 8.7.30, 9.x before 9…7.2
• CVE-2019-19851An XSS Injection vulnerability exists in Sangoma FreePBX and…4.8
• CVE-2019-19852An XSS Injection vulnerability exists in Sangoma FreePBX and…4.8
• CVE-2019-19854An issue was discovered in Serpico (aka SimplE RePort wrItin…8.8