Skip to content
brandefense.io
Request A Demo
WatchlistCritical

CVE-2019-6714Blogengine.net Path Traversal

A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem.

Published Mar 21, 2019 · Updated Aug 27, 2026

Key Facts

Patch immediately
  • CVE-2019-6714 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Blogengine.net.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 32% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Blogengine.net <=3.3.6.0, Blogengine.net 3.3.6.0.
  • Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v3.1

9.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

32%

Higher than 98.2% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

47/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

3

Proof-of-concept links

In-the-wild evidence

0

Reports of active use

Advisories And Exploit References

Description

An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem.

This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.

Affected Products

1 affected entries in total
ProductAffected versionsFixed in
Blogengine.netBlogengineSee advisory3.3.6.0

Patched Releases

Blogengine.net

<=3.3.6.0

Timeline

  1. Publicly disclosed

    Mar 21, 2019

  2. Last updated

    Aug 27, 2026

Weakness Type

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

1 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2019-6714 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.

Request A Demo

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.