CVE-2019-16317

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different...

CVE-2019-16317

CVE-2019-16317 targets Pimcore before 5.7.1. Affected component/issue: PHAR upload handling, where a filename parameter can be used with a phar:// URL to trigger execution of a .phar file. Attacker with limited privileges can exploit this to achieve code execution, with uploads reachable within t...