DescriptionWordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs923583

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wordpress (PTS)buster5.0.15+dfsg1-0+deb10u1undetermined
buster (security)5.0.21+dfsg1-0+deb10u1undetermined
bullseye (security)5.7.11+dfsg1-0+deb11u1undetermined
bookworm (security)6.1.6+dfsg1-0+deb12u1undetermined
sid, trixie6.5.3+dfsg1-1undetermined

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[jessie] - wordpress <postponed> (requires privileged account, not directly exploitable as CVE-2019-8942 is fixed, no official patch)
This CVE is explicitly for the mentioned Path Traversal in wp_crop_image().
Patching CVE-2019-8942 makes CVE-2019-8943 (RCE) not directly exploitable
RCE would now require a vulnerable plugin, and a crop-resistant PHP webshell embedded in an image (preserved EXIF data, PNG IDAT reverse deflate...)

Search for package or bug name: Reporting problems