CVE-2019-8408: OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice.

Routine

MEDIUM 4.9DOWNGRADE

CVE-2019-8408 is a medium-severity flaw (CVSS 4.9) affecting onefilecms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice.

Why this priority

Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	4.9 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	High
User interaction	None
EPSS exploit chance	1.2% (top 31%)
CISA exploited list	No
Published	2019-02-17
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: onefilecms

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-02-17 18:29 UTCPublished CVE record published
2026-06-17 02:41 UTCUpdated Record last modified

onefilecms onefilecms DOWNGRADE

Affected: 3.6.13

Fixed in: no fixed release known

Safe to downgrade to: a release before 3.6.13

1. Check installed version

apt-cache policy onefilecms || rpm -q onefilecms || onefilecms --version

2. No fixed release: DOWNGRADE to a release before 3.6.13 (Debian / Ubuntu)

apt-cache madison onefilecms sudo apt install onefilecms=<VERSION_BEFORE_3.6.13> sudo apt-mark hold onefilecms

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list onefilecms sudo dnf downgrade onefilecms-<VERSION_BEFORE_3.6.13> sudo dnf versionlock add onefilecms

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-8408?

onefilecms: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-8408 being exploited?

CVE-2019-8408 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-8408 affect?

CVE-2019-8408 affects onefilecms. Severity is medium (CVSS 4.9). OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice.

How urgent is CVE-2019-8408?

Priority 39/100. Public exploit reference

Software pages

PHP vulnerabilities

Related CVEs

CVE-2018-13123 CRITICAL 9.8 UPGRADE onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f
CVE-2018-13122 MEDIUM 6.5 UPGRADE onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete
CVE-2018-12995 HIGH 8.8 UPGRADE onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php
CVE-2018-12994 HIGH 8.8 UPGRADE onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php
CVE-2018-12993 CRITICAL 9.8 UPGRADE onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the o

References

← Back to latest CVEs