CVE-2019-25351 HIGH

CVE-2019-25351: Centova Cast 3.2.11 - Arbitrary File Download

Vendor Centova Technologies Inc.

Product Centova Cast

Weakness CWE-862 · Missing authorization

Published February 18, 2026

Last update February 19, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to retrieve arbitrary system files through the server.copyfile API endpoint. Attackers can exploit the vulnerability by supplying crafted parameters to download sensitive files like /etc/passwd using curl and wget requests.

Key dates

02Disclosure timeline

February 18, 2026 CVE published

February 19, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25351 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-56243 WordPress WPSSO Core plugin <= 18.18.1 - Broken Access Control vulnerability CVE-2025-2224 Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing CVE-2025-58753 copyparty: Sharing a single file does not fully restrict access to other files in source folder CVE-2024-34758 WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control vulnerability CVE-2025-24737 WordPress WP Helper Premium plugin <= 4.6.1 - Broken Access Control vulnerability