CVE-2019-16318: Unrestricted Upload of File with Dangerous Type

September 14, 2019 (updated September 17, 2019)

In Pimcore, an attacker with limited privileges can bypass file-extension restrictions via a filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames.

References

nvd.nist.gov/vuln/detail/CVE-2019-16318

Detect and mitigate CVE-2019-16318 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →