CVE-2019-9949

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root, starting from a low-privilege user session) vulnerability. The cgi-bin/webfile_mgr.cgi file allows arbitrary file write by abusing symlinks. Specifically, this occurs by uploading a tar archive that contains a symbolic link, then uploading another archive that writes a file to the link using the "cgi_untar" command. Other commands might also be susceptible. Code can be executed because the "name" parameter passed to the cgi_unzip command is not sanitized.

• CWE-59

• https://bnbdr.github.io/posts/wd/Exploit, Third Party Advisory
• https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-183-05-20-2019/237717Vendor Advisory
• https://github.com/bnbdr/wd-rce/Exploit, Third Party Advisory
• https://bnbdr.github.io/posts/wd/Exploit, Third Party Advisory
• https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-183-05-20-2019/237717Vendor Advisory
• https://github.com/bnbdr/wd-rce/Exploit, Third Party Advisory

Published

May 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9943In ome.services.graphs.GraphTraversal.findObjectDetails in O…7.5
• CVE-2019-9944In Open Microscopy Environment OMERO.server 5.0.0 through 5.…7.5
• CVE-2019-9945SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command executio…
• CVE-2019-9946Cloud Native Computing Foundation (CNCF) CNI (Container Netw…
• CVE-2019-9947An issue was discovered in urllib2 in Python 2.x through 2.7…6.1
• CVE-2019-9948urllib in Python 2.x through 2.7.16 supports the local_file:…9.1
• CVE-2019-9950Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2…
• CVE-2019-9951Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2…
• CVE-2019-9955On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG4…
• CVE-2019-9956In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer o…
• CVE-2019-9957Stored XSS within Quadbase EspressReport ES (ERES) v7.0 upda…
• CVE-2019-9958CSRF within the admin panel in Quadbase EspressReport ES (ER…