CVE-2019-16278
Nostromo nhttpd Directory Traversal Vulnerability
Published Oct 14, 2019 · updated Jun 16, 2026 · nazgul nostromo nhttpd
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2019 · Catalog
Detected
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Nov 7, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Nov 28, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Nov 28, 2024
Affected
- cpe nazgul/nostromo nhttpdversion unspecified
- vendor Nostromo nhttpdversion unspecified
Sources
- CISA KEVCVE-2019-16278
Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
cisa.gov - CVE.orgCVE-2019-16278
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-16278
30-day exploitation probability 99.0%
first.org - Exploit Database47573
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database47837
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/nostromo_code_exec
Public module reference (good). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2019-16278
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com