CVE-2019-12161: Webpagetest

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).

Affected products

• Webpagetest Webpagetest: version 19.04 only

Published 2019-05-17. Last modified 2026-06-17.