CVE-2019-25579 phpTransformer 2016.9 Directory Traversal via jQueryFileUpload
Unauthenticated attackers can access arbitrary files outside the intended directory by manipulating path parameters in phpTransformer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25579?
CVE-2019-25579 is a high-severity path traversal vulnerability in phpTransformer, published on 21 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpTransformer 2016.9 contains a directory traversal vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the path parameter. Attackers can send requests to the jQueryFileUploadmaster server endpoint with traversal sequences ../../../../../../ to list and retrieve files outside the intended directory.
Weakness: CWE-22
Which versions are affected by CVE-2019-25579?
It affects 1 product.
Products include Codnloc Phptransformer.
How do I fix CVE-2019-25579?
No fix has been published for CVE-2019-25579 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-25579 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25579 exists.
Other vulnerabilities in phpTransformer
Sources
Also known as GHSA-5w97-394v-8832.