CVE-2019-16679

MEDIUM

Gila CMS < 1.11.1 - Path Traversal and Local File Inclusion via Admin File Manager

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-16679. PoCs published by Sainadh Jamalpur.

AI-analyzed exploit summary This exploit demonstrates an authenticated Local File Inclusion (LFI) vulnerability in GilaCMS 1.10.9. By manipulating the 'f' parameter in the admin file manager, an attacker can traverse directories and read arbitrary files on the server.

Description

Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.

Exploits (1)

exploitdb WORKING POC
by Sainadh Jamalpur · textwebappsmultiple
https://www.exploit-db.com/exploits/47407

This exploit demonstrates an authenticated Local File Inclusion (LFI) vulnerability in GilaCMS 1.10.9. By manipulating the 'f' parameter in the admin file manager, an attacker can traverse directories and read arbitrary files on the server.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: GilaCMS 1.10.9
Auth required
Prerequisites: Admin or equivalent user credentials
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/GilaCMS/gila/issues/33
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/GilaCMS/gila/releases/tag/1.11.1

Scores

CVSS v3 4.9
EPSS 0.0703
EPSS Percentile 93.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (1)
gilacms/gila_cms < 1.11.1
Published Sep 21, 2019
Tracked Since Feb 18, 2026