CVE-2019-19509: rConfig

High severity, CVSS 8.8. EPSS: 71.6% chance of exploitation in the next 30 days.

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.

Affected products

• rConfig rConfig: version 3.9.3 only

Published 2020-01-06. Last modified 2026-06-17.