CVE-2019-10719: Dotnetblogengine Blogengine.net

High severity, CVSS 8.8. EPSS: 7.6% chance of exploitation in the next 30 days.

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.

Affected products

• Dotnetblogengine Blogengine.net: up to and including 3.3.7.0

Published 2019-06-21. Last modified 2026-06-17.