Which versions of PHP are affected by CVE-2019-25480?

ARMBot contains a critical file upload vulnerability that allows attackers to upload malicious files without authentication, potentially leading to system compromise, data theft, or operational…

Is there a public PoC exploit available for CVE-2019-25480?

Yes, a public proof-of-concept exploit is available for CVE-2019-25480. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2019-25480?

Within 24 hours: Inventory all ARMBot instances and isolate affected systems from production networks if operationally feasible; document current version and deployment locations. Within 7 days: Implement WAF rules to block path traversal sequences in upload requests and restrict upload.php access to authorized IPs only; enable detailed logging on upload endpoints. Within 30 days: Contact ARMBot vendor for patch timeline; evaluate alternative solutions or plan controlled decommissioning; conduct forensic analysis for evidence of exploitation.

PHP CVE-2019-25480

Q: What is the CVSS score of CVE-2019-25480?

CVE-2019-25480 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Path Traversal (CWE-22)

2026-03-11 disclosure@vulncheck.com

PHP RCE Path Traversal File Upload

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 15, 2026 - 15:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

PoC Detected

Mar 12, 2026 - 21:08 vuln.today

Public exploit code

CVE Published

Mar 11, 2026 - 19:16 nvd

HIGH 7.5

DescriptionCVE.org

ARMBot contains an unrestricted file upload vulnerability in upload.php that allows unauthenticated attackers to upload arbitrary files by manipulating the file parameter with path traversal sequences. Attackers can upload PHP files with traversal payloads ../public_html/ to write executable code to the web root and achieve remote code execution.

AnalysisAI

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects upload.php. ARMBot contains an unrestricted file upload vulnerability in upload.php that allows unauthenticated attackers to upload arbitrary files by manipulating the file parameter with path traversal sequences. Attackers can upload PHP files with traversal payloads ../public_html/ to write executable code to the web root and achieve remote code execution.

Affected ProductsAI

Product: upload.php.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.