Security readout for executives and security teams
Plain-English summary
CVE-2019-19745 affects Contao 4.0 through 4.8.5. A logged-in back-end user with form generator access may upload files that can be executed on the server, turning a content-management feature into a server compromise path.
Executive priority
Prioritize remediation where Contao back-end access is shared, delegated, or exposed to many users. The issue can lead to server-side code execution, but the available evidence indicates an authenticated precondition and no confirmed active exploitation.
Technical view
The reported issue is PHP local file inclusion tied to unrestricted file upload behavior in Contao. The source states that a back-end user with form generator access can upload arbitrary files and execute them server-side.
Likely exposure
Exposure is limited to Contao installations running versions 4.0 through 4.8.5, especially where untrusted or lower-privileged users have back-end access to the form generator.
Exploitation context
The provided sources do not show active exploitation, and this CVE is not marked as CISA KEV. Exploitation requires authenticated back-end access with form generator permissions, based on the CVE description.
Researcher notes
The public bundle lacks CVSS, CWE, exact fixed version, and detailed exploit conditions. Treat the vendor advisory as the authoritative source for patch details and avoid assuming unauthenticated reachability.
Mitigation direction
- Review the Contao advisory for the vendor-confirmed fixed release and upgrade path.
- Upgrade affected Contao installations to a vendor-supported fixed version.
- Restrict form generator access to trusted administrators until remediation is complete.
- Audit back-end accounts and remove unnecessary or stale access.
- Review uploaded files for unexpected executable PHP content.
Validation and detection
- Inventory Contao instances and confirm whether versions are 4.0 through 4.8.5.
- Identify users or roles with back-end form generator access.
- Check whether vendor remediation from the Contao advisory has been applied.
- Review web-accessible upload locations for executable server-side files.
- Confirm the CVE is not being treated as actively exploited without new evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19745 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://contao.org/en/news.htmlCVE reference · x_refsource_MISC
- https://contao.org/en/security-advisories/unrestricted-file-uploads.htmlCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.