CVE-2019-25579
Published: 21 March 2026
Summary
CVE-2019-25579 is a high-severity Path Traversal (CWE-22) vulnerability in Codnloc Phptransformer. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 38.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25579 is a directory traversal vulnerability (CWE-22) affecting phpTransformer version 2016.9. The issue exists in the jQueryFileUploadmaster server endpoint, where the path parameter can be manipulated using traversal sequences such as ../../../../../../, enabling unauthenticated attackers to list and retrieve arbitrary files outside the intended directory.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges or user interaction, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Successful exploitation grants read access to sensitive files, leading to high confidentiality impact without affecting integrity or availability.
References include an exploit proof-of-concept on Exploit-DB (https://www.exploit-db.com/exploits/46192), a Vulncheck advisory detailing the directory traversal via jQueryFileUpload (https://www.vulncheck.com/advisories/phptransformer-directory-traversal-via-jqueryfileupload), the phpTransformer website (http://phptransformer.com/), and a download link for the affected release (https://netcologne.dl.sourceforge.net/project/phptransformer/Version%202016.9/release_2016.9.zip). No patches or specific mitigations are described in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19902
Vulnerability details
phpTransformer 2016.9 contains a directory traversal vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the path parameter. Attackers can send requests to the jQueryFileUploadmaster server endpoint with traversal sequences ../../../../../../ to list and retrieve files outside the…
more
intended directory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal enables remote file/directory enumeration (T1083) and arbitrary file read from the local system (T1005) via unauthenticated exploitation of a public-facing web application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the path parameter in the jQueryFileUploadmaster endpoint to reject directory traversal sequences like '../../../../ ../../', directly preventing unauthorized access to arbitrary files.
Mandates identification, reporting, and correction of the specific directory traversal flaw in phpTransformer 2016.9, eliminating the vulnerability through patching or code fixes.
Enforces access control policies on file system resources to restrict reads to intended directories, mitigating the impact of path manipulation attempts.