CVE-2019-16278
Nostromo nhttpd Directory Traversal Vulnerability
Published Oct 14, 2019 · updated Jun 16, 2026 · nazgul nostromo nhttpd
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2019 · Catalog
Detected
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Nov 7, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Nov 28, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Nov 28, 2024
Affected
- cpe nazgul/nostromo nhttpdversion unspecified
- vendor Nostromo nhttpdversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2019-16278
Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
cisa.gov - CVE.orgVulnerability recordCVE-2019-16278
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-16278
30-day exploitation probability 99.0%
first.org - Exploit DatabasePublic exploit reference47573
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference47837
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_multi/http/nostromo_code_exec
Public module reference (good). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2019-16278
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com