CVE-2019-9889

In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server.

• CWE-22

• https://github.com/vanilla/vanilla/compare/b043ae8...9f12b22Third Party Advisory
• https://github.com/vanilla/vanilla/pull/7840Third Party Advisory
• https://hackerone.com/reports/411140Exploit, Third Party Advisory
• https://github.com/vanilla/vanilla/compare/b043ae8...9f12b22Third Party Advisory
• https://github.com/vanilla/vanilla/pull/7840Third Party Advisory
• https://hackerone.com/reports/411140Exploit, Third Party Advisory

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9881The createComment mutation in the WPGraphQL 0.2.3 plugin for…
• CVE-2019-9882Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
• CVE-2019-9883Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
• CVE-2019-9884eClass platform < ip.2.5.10.2.1 allows an attacker to use GE…9.8
• CVE-2019-9885eClass platform < ip.2.5.10.2.1 allows an attacker to execut…9.8
• CVE-2019-9886Any URLs with download_attachment.php under templates or hom…7.5
• CVE-2019-9890An issue was discovered in GitLab Community and Enterprise E…
• CVE-2019-9891The function getopt_simple as described in Advanced Bash Scr…
• CVE-2019-9892An issue was discovered in Open Ticket Request System (OTRS)…6.5
• CVE-2019-9893libseccomp before 2.4.0 did not correctly generate 64-bit sy…
• CVE-2019-9894A remotely triggerable memory overwrite in RSA key exchange …
• CVE-2019-9895In PuTTY versions before 0.71 on Unix, a remotely triggerabl…