CVE-2019-10720: Blogengine Blogengine.net

High severity, CVSS 8.8. EPSS: 7.1% chance of exploitation in the next 30 days.

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.

Affected products

• Blogengine Blogengine.net: up to and including 3.3.7.0

Published 2019-06-21. Last modified 2026-06-17.