CVE-2019-10767: Iobroker Iobroker.js-Controller

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to be logged in if the authentication is enabled (by default isn't enabled).

Affected products

• Iobroker Iobroker.js-Controller: before 2.0.25 (fixed in 2.0.25)

Published 2019-11-21. Last modified 2026-06-17.