Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.
Priority MEDIUM 46CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).
Why it matters now
EPSS 0.11617 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:roxyfileman:roxy_fileman:1.4.5:*:*:*:*:*:*:* | 1.4.5 | Vulnerable | Roxyfileman |
- cpe:2.3:a:roxyfileman:roxy_fileman:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·Roxyfileman
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-19731
- 2026-10-03 Alias added: GHSA-7frw-x8xq-rfcq
References
More Roxyfileman Roxy Fileman vulnerabilities
- TI-2022-19405 Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default… CVSS 3.1CRITICAL 9.8
- TI-2018-14554 Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php. CVSS 3.0CRITICAL 9.8
- TI-2018-14553 Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php. CVSS 3.1CRITICAL 9.1
- TI-2019-05091 Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File)… CVSS 3.0CRITICAL 9.8
- TI-2018-08633 Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter. CVSS 3.0HIGH 7.5
Sources
- CVE-2019-19731 · CVE Program
- CVE-2019-19731 · NVD
- FIRST EPSS
- GHSA-7frw-x8xq-rfcq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences