Is there a public PoC exploit available for CVE-2026-16219?

Yes, a public proof-of-concept exploit is available for CVE-2026-16219. Prioritise patching immediately. EPSS: 0.3%.

Croogo CMS CVE-2026-16219

Q: What is the CVSS score of CVE-2026-16219?

CVE-2026-16219 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45430 LOW

Path Traversal (CWE-22)

2026-07-19 VulDB

GHSA-mwrx-jx87-85xc

Path Traversal PHP Cms

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Requires low-privileged authenticated admin access (PR:L); path traversal yields limited file read/write outside web root with no scope change to adjacent systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 19, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

Jul 19, 2026 - 07:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 19, 2026 - 07:16 vuln.today

CVE Published

Jul 19, 2026 - 06:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in Croogo CMS up to version 4.0.7 allows remote authenticated attackers to escape the intended file management directory by supplying crafted path sequences to the Admin File Manager's FileManager::isEditable function in FileManager/src/Utility/FileManager.php. A public proof-of-concept exploit exists and has been disclosed via a researcher advisory, while the Croogo project has not responded to the responsible disclosure report and no patch has been released. The vulnerability carries a medium base score but the combination of a public PoC, unresponsive vendor, and no remediation path meaningfully elevates practical risk for any internet-exposed Croogo instance.

Technical ContextAI

Croogo is an open-source PHP-based content management system built on the CakePHP framework. The affected component is the Admin File Manager, which provides authenticated CMS users with browser-based file browsing and editing capability. The root cause is CWE-22 (Path Traversal): the FileManager::isEditable method in FileManager/src/Utility/FileManager.php does not properly sanitize user-controlled file path input, allowing directory traversal sequences such as ../ or URL-encoded equivalents to escape the intended base directory and reference arbitrary filesystem paths. The CPE string cpe:2.3:a:croogo:cms:*:*:*:*:*:*:*:* covers all Croogo CMS versions through 4.0.7. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N reflects that the flaw is reachable over the network with low complexity, but requires at minimum low-privileged authenticated access to the admin interface.

RemediationAI

No vendor-released patch is available at time of analysis - the Croogo project has not responded to disclosure and no fixed version has been confirmed. The most effective compensating control is to disable or uninstall the FileManager plugin/component entirely, eliminating the attack surface at the cost of browser-based file editing functionality. If FileManager must remain active, restrict admin panel access to trusted IP ranges or require VPN access, preventing remote exploitation even with valid credentials. Implement a web application firewall rule to detect and block path traversal patterns (../, ..%2F, ..%5C, and double-encoded variants) targeting file manager endpoints. Enforce strong, unique credentials for all CMS admin accounts and consider limiting file manager access to a minimum set of administrator roles. Monitor the GitHub issue at https://github.com/croogo/croogo/issues/1008 and the VulDB entry at https://vuldb.com/vuln/380042 for any upstream patch release.