CVE-2019-25480 - ARMBot Unrestricted File Upload via upload.php

Back Back to CVE browser

HIGH

ARMBot Unrestricted File Upload via upload.php

Published Mar 11, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.72%

Description

ARMBot contains an unrestricted file upload vulnerability in upload.php that allows unauthenticated attackers to upload arbitrary files by manipulating the file parameter with path traversal sequences. Attackers can upload PHP files with traversal payloads ../public_html/ to write executable code to the web root and achieve remote code execution.

Affected products

Vendor ARMBot Product ARMBot Default
unaffected

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ARMBot

unaffected

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19760
Advisory
https://www.exploit-db.com/exploits/47209
exploit
https://www.vulncheck.com/advisories/armbot-unrestricted-file-upload-via-upload-php
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19760		Advisory
https://www.exploit-db.com/exploits/47209		exploit
https://www.vulncheck.com/advisories/armbot-unrestricted-file-upload-via-upload-php		third-party-advisory