VULNERABILITY INTELLIGENCE

CVE-2019-12150

CVSS score9.8 CRITICAL

EPSS probability1.73%

CISA KEVNot currently listed

Published2019-05-24

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted). The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under the UltimateEditorInclude/UserFiles/ URI.

Weakness classification

CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references

cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Product, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory