CVE-2018-19422: Subrion CMS upload panel allows PHP code execution via .pht/.phar files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.2 HIGH with public exploit code and a very high EPSS score (99.19th percentile) make this a strong candidate for exploitation despite the required authenticated access.

What it is

Subrion CMS 4.2.1 permits uploads of .pht and .phar files through /panel/uploads because its .htaccess does not block those extensions. An authenticated attacker with panel access can upload a PHP-executable file and run arbitrary code on the server. The flaw is an unrestricted file upload (CWE-434) rated CVSS 3.1 7.2 HIGH.

Impact

An attacker gains remote code execution under the web server's account, allowing full compromise of the CMS and any data or host resources reachable from it.

Attack surface

Reached over the network via the /panel/uploads endpoint; the CVSS vector (PR:H) indicates high privileges are required, meaning an authenticated administrative or panel user is needed, and no user interaction is required.

Exploitation

Public exploit references exist (Packet Storm and a GitHub issue tagged Exploit), and EPSS is 0.64261 (99.19th percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV.

What to do

• Upgrade Subrion CMS past 4.2.1 to a release that blocks .pht and .phar uploads, or apply the vendor fix referenced in the GitHub issue.
• If patching is not possible, extend the upload directory .htaccess to deny execution of .pht, .phar, .php and other executable extensions.
• Restrict and audit accounts with panel upload access; enforce least privilege and strong authentication for administrative users.
• Configure the web server to serve the uploads directory as static content only, disabling script execution there.
• Monitor and alert on new files written to /panel/uploads, especially those with .pht or .phar extensions.

Detection

• Alert on file creation events in the /panel/uploads directory, particularly .pht, .phar, .php and other script extensions.
• Review web server logs for POST requests to /panel/uploads followed by requests to the uploaded file path.
• Search the filesystem for unexpected executable files under upload directories and compare against known-good content.
• Monitor for outbound connections or child processes spawned by the web server user that indicate uploaded code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.