CVE-2019-16409 json
SilverStripe Versioned Files module Unpublished files are exposed publicly
published 2019-09-26 7 y ago modified 2026-06-17 4 mo ago also GHSA-xm6j-x342-gwq9 , EUVD-2019-0767
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
Patch / fix
- packagist silverstripe/framework 4.3.5, 4.4.4
Exploit prediction
1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | symbiote/silverstripe-versionedfiles | <=2.0.3 |
no fix listed |
| packagist | silverstripe/framework | >=4.0.0, <4.3.5 >=4.4.0, <4.4.4 |
4.3.5 4.4.4 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
silverstripe.org
/download/security-releases/cve-2019-16409
web, vendor-advisory
-
github.com
/symbiote/silverstripe-versionedfiles
web, product, third-party-advisory
-
github.com
/silverstripe/silverstripe-framework
web, product, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2019-16409
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-16409.yaml
web
Sources
- CVE List CVE-2019-16409
- GitHub Advisory GHSA-xm6j-x342-gwq9
- NVD CVE-2019-16409
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.