{"schemaVersion":3,"id":"CVE-2019-9858","aliases":["UBUNTU-CVE-2019-9858","DEBIAN-CVE-2019-9858","DLA-1822-1","DSA-4468-1"],"status":"published","duplicateOf":null,"title":null,"description":"Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms, which default to securely using a random path.)","dates":{"published":"2019-05-29T16:26:06.000Z","modified":"2024-08-04T22:01:55.132Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.5,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.18834,"percentile":0.97277,"severity":"medium","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.18834},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.19165,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.19165,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.19165,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.19165,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.19165,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.18834,"percentile":0.97277}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.18834,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.18834,"percentile":0.97277}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_2CFDAB7BDCF47F7E","name":"Exploit Reference (ssd-disclosure.com)","source":"reference","url":"https://ssd-disclosure.com/?p=3814&preview=true","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_5A296383F465BEF3","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/152476/Horde-Form-Shell-Upload.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_MULTI_HTTP_HORDE_FORM_FILE_UPLOAD","name":"Horde Form File Upload Vulnerability","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/http/horde_form_file_upload.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":true,"exploitdb":null,"metasploit":{"fullname":"exploit/multi/http/horde_form_file_upload","rank":"600","rankName":"excellent","postAuth":true,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":3,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"debian","product":"php-horde-form","name":"php-horde-form","label":"php-horde-form","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/php-horde-form","purlType":"deb","versions":[{"text":"< 2.0.18-3.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.0.15-1+deb9u1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.0.8-2+deb8u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.18-3.1 | < 2.0.15-1+deb9u1 | < 2.0.8-2+deb8u1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php-horde-form","name":"php-horde-form","label":"php-horde-form","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php-horde-form","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0 | 9.0","eol":{"isEol":true,"eolDate":"2020-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"8","label":"8 (Jessie)","eolFrom":"2020-06-30T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"8.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"horde","product":"groupware","name":"groupware","label":"groupware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.2.17","noFixRecorded":false,"fixedIn":null},{"text":"5.2.22","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.2.17 | 5.2.22","eol":null,"hubHref":"/vendor/horde/groupware"}],"affectedCount":4,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://ssd-disclosure.com/?p=3814&preview=true","label":"ssd-disclosure.com?p=3814&preview=true","hostname":"ssd-disclosure.com","tags":["X Refsource MISC","REPORT","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/152476/Horde-Form-Shell-Upload.html","label":"packetstormsecurity.com/files/152476/Horde-Form-Shell-Upload.html","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","REPORT","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00007.html","label":"lists.debian.org/debian-lts-announce/2019/06/msg00007.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST","REPORT","Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4468","label":"www.debian.org/security/2019/dsa-4468","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","REPORT","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Jun/31","label":"seclists.org/bugtraq/2019/Jun/31","hostname":"seclists.org","tags":["Mailing List","X Refsource BUGTRAQ","REPORT","Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9858","label":"ubuntu.com/security/CVE-2019-9858","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ssd-disclosure.com/archives/3814/ssd-advisory-horde-groupware-webmail-authenticated-arbitrary-file-injection-to-rce","label":"ssd-disclosure.com/archives/…","hostname":"ssd-disclosure.com","tags":["REPORT"]},{"url":"https://github.com/horde/Form/commit/c916ba979ad1613d76a9407dd0b67968a9594c0e","label":"github.com/horde/Form/commit/c916ba979ad1613d76a9407dd0b67968a9594c0e","hostname":"github.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9858","label":"www.cve.org/CVERecord?id=CVE-2019-9858","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9858","label":"security-tracker.debian.org/tracker/CVE-2019-9858","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-05-29T16:26:06.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T22:01:55.132Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":49,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T18:47:45.508Z","stale":false,"partial":false}}