CVE-2019-8943

NameCVE-2019-8943
DescriptionWordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs923583

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wordpress (PTS)jessie4.1+dfsg-1+deb8u17vulnerable
jessie (security)4.1.26+dfsg-1+deb8u1vulnerable
stretch (security), stretch4.7.5+dfsg-2+deb9u5vulnerable
buster5.0.4+dfsg1-1vulnerable
sid5.2.1+dfsg1-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wordpresssource(unstable)(unfixed)medium923583

Notes

[jessie] - wordpress <no-dsa> (Patching CVE-2019-8942 makes CVE-2019-8943 unexploitable)
https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/
The code execution angle is fixed via gd security, details on the rest are murky.
This CVE is explicitly for the mentioned Path Traversal in wp_crop_image().
https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/#path-traversal-via-modified-post-meta
https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/#exploiting-the-path-traversal-lfi-in-theme-directory

Search for package or bug name: Reporting problems