CVE-2019-13396: FlightPath form_include parameter path traversal and local file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote file disclosure with public exploit code and very high EPSS, though CVSS confidentiality-only impact is medium.

What it is

FlightPath 4.x and 5.0-x passes the form_include parameter from an index.php?q=system-handle-form-submit POST request into an include_once call in system_handle_form_submit in modules/system/system.module without proper validation. This allows directory traversal and local file inclusion, letting an unauthenticated remote attacker read files on the server. The flaw matters because it exposes sensitive local files and can aid further compromise.

Impact

An attacker can read arbitrary local files accessible to the web server process, potentially exposing configuration, credentials, or other sensitive data. The CVSS vector limits impact to confidentiality only, with no integrity or availability effect.

Attack surface

Reachable over the network via a crafted POST request to index.php?q=system-handle-form-submit with a malicious form_include parameter. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

No CISA KEV listing, but EPSS is 0.62572 (99.152 percentile), indicating high predicted exploitation activity. Public exploit references are present (Packet Storm), confirming exploit code is available.

What to do

• Apply the vendor fix or upgrade FlightPath to a version that validates the form_include parameter; check getflightpath.com/node/2650 for the advisory.
• If patching is not immediately possible, restrict or block access to index.php?q=system-handle-form-submit and sanitize/whitelist the form_include parameter at the web server or WAF.
• Run the web server with least privilege and restrict filesystem read access so traversal cannot reach sensitive files.
• Monitor and review logs for POST requests to system-handle-form-submit containing traversal sequences in form_include.

Detection

• Search web server logs for POST requests to index.php?q=system-handle-form-submit with form_include values containing ../ or absolute paths.
• Alert on include_once-related errors or unusual file access patterns from the FlightPath web process.
• Use a WAF rule to flag traversal sequences in the form_include parameter on system-handle-form-submit requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.