High
Security advisory
Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-12816
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:32 UTC · Revision 1
Source evidence
Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.
osv:CVE-2019-12816
Complete source record
{
"id": "3f2baa4e3c7286b2e042f54dd5a3e872df33c1bbcb4a90d7f3353f9f34e6ae19",
"url": "https://osv.dev/vulnerability/CVE-2019-12816",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-12816",
"summary": "Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.",
"evidence": "osv:CVE-2019-12816",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-12816",
"aliases": [
"CVE-2019-12816"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/znc/znc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "be1b6bcd4cafbc57ebc298d89a5402ae7df55a8a"
},
{
"fixed": "8de9e376ce531fe7f3c8b0aa4876d15b479b7311"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:znc:znc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.7.3"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "8de9e376ce531fe7f3c8b0aa4876d15b479b7311"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"znc-1.7.3",
"znc-1.7.3-rc1",
"znc-1.7.2",
"znc-1.7.2-rc1",
"znc-1.7.1",
"znc-1.7.1-rc1",
"znc-1.7.0",
"znc-1.6.0",
"znc-1.2",
"znc-1.0",
"znc-0.200",
"znc-0.098",
"znc-0.096",
"znc-0.094",
"znc-0.072",
"znc-0.070",
"znc-0.068",
"znc-0.066",
"znc-0.064",
"znc-0.062",
"znc-0.060",
"znc-0.058",
"znc-0.056",
"znc-0.054",
"znc-0.054-rc3",
"znc-0.054-rc2",
"znc-0.054-rc1",
"znc-0.052",
"znc-0.050",
"znc-0.047",
"znc-0.045",
"znc-0.044",
"znc-0.043",
"znc-0.041",
"znc-0.040",
"znc-0.039",
"znc-0.038",
"znc-0.037",
"znc-0.036",
"znc-0.035",
"znc-0.034",
"znc-0.033",
"znc-0.030",
"znc-0.029",
"znc-0.028",
"znc-0.027",
"znc-0.025",
"znc-0.023"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12816.json",
"vanir_signatures": [
{
"id": "CVE-2019-12816-1290c1b3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174486753964754430516916736730871383050",
"29275778477837198611450992203257197893",
"307319530049013881402330522505066602242",
"82494158934045587906733452887499443976",
"160053286842728736588820086884220847764",
"287617424539222821611460032335993242581",
"209833765287222228824183705683832732667",
"95297945510039220468508204114214847500",
"236450068995647934809680474209327232539",
"95912614378945415831535891127074118283",
"219679646820246493502379246107279975593",
"300337625527040063029589176392118851540",
"204297166171023547714016822031300809515",
"73956343658827535355290124036992016914",
"18051496777745318297934926575655174890",
"239034098034606290967669952118796928569",
"295334044853165642485678087140871457774",
"45729926670722493656673669137202336290",
"571798546533859822310861521896058965",
"211380172655941171035773268297891516276",
"331984331098265596437389312867452663890",
"259182456096102161138887388896962333935",
"278816252438430496865286650787102721943",
"225602893450083304814145166244640416013",
"154036182678273576774730331226380439075",
"252388954425318239832020560689011993945",
"274893726036052713575377647643003236381"
]
},
"source": "https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311",
"target": {
"file": "src/Modules.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-12816-3fbc7f94",
"digest": {
"length": 1917,
"function_hash": "95122950786339445404760154917654623114"
},
"source": "https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311",
"target": {
"file": "src/Modules.cpp",
"function": "CModules::LoadModule"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-12816-48abef31",
"digest": {
"length": 288,
"function_hash": "323292578912875305148883135426334201462"
},
"source": "https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311",
"target": {
"file": "src/Modules.cpp",
"function": "CModules::GetModPathInfo"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-12816-54fbb26a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"195477839036768438441414840661911920399",
"210936151725103424132817371752203593323",
"101777677667273448383554422736045543017",
"302797354415093651132654681454522280047"
]
},
"source": "https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311",
"target": {
"file": "include/znc/Modules.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-12816-b44be469",
"digest": {
"length": 397,
"function_hash": "76020489109695436136136009632747957875"
},
"source": "https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311",
"target": {
"file": "src/Modules.cpp",
"function": "CModules::GetModInfo"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-12816-d5a0c88d",
"digest": {
"length": 1924,
"function_hash": "29121335711093038551819019924020777549"
},
"source": "https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311",
"target": {
"file": "src/Modules.cpp",
"function": "CModules::OpenModule"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:47:39Z"
}
}
],
"modified": "2026-10-20T13:47:39.725260559Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2019/06/msg00017.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4O24TQOB73X57GACLZVMRVUK4UKHLE5G/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHR6OD52FQAG5ZPZ42NJM2T765C3V2XC/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEESIGRNFLZUWXZPDGXAZ7JZTHYBDJ7G/",
"https://usn.ubuntu.com/4044-1/",
"https://seclists.org/bugtraq/2019/Jun/23",
"https://security.gentoo.org/glsa/201908-15",
"https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311",
"https://github.com/znc/znc/compare/be1b6bc...d1997d6"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-12816",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388234,
"published_at": "2019-06-15T16:29:00.21+00:00"
}