CVE-2019-12816: Input Validation
Last updated 25 August 2025
Other sources
Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zncto a version that resolves this vulnerability.Fixed in 1.8.2-2+deb11u1Fixed in 1.8.2-3.1+deb12u1Fixed in 1.9.1-2Fixed in 1.10.1-1 - Upgrade
Upgrade
alpine/zncto a version that resolves this vulnerability.Fixed in 1.7.4-r0 - Upgrade
Upgrade
alpine/zncto a version that resolves this vulnerability.Fixed in 1.7.1-r1 - Upgrade
Upgrade
alpine/zncto a version that resolves this vulnerability.Fixed in 1.7.1-r4 - Upgrade
Upgrade
ZNCto a version that resolves this vulnerability.Fixed in 1.7.4-rc1
Event History
Frequently Asked Questions
What is CVE-2019-12816?
CVE-2019-12816 is a vulnerability in ZNC before 1.7.4-rc1 that allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.
How does CVE-2019-12816 impact ZNC?
CVE-2019-12816 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code on ZNC servers.
What is the severity of CVE-2019-12816?
The severity of CVE-2019-12816 is high with a CVSS score of 8.8.
Which versions of ZNC are affected by CVE-2019-12816?
ZNC versions before 1.7.4-rc1 are affected by CVE-2019-12816.
How can I fix CVE-2019-12816 on my ZNC server?
To fix CVE-2019-12816, you need to update your ZNC installation to version 1.7.4-rc1 or later.