Path traversal in nostromo nhttpd - CVE-2019-16278
Published: November 1, 2019 / Updated: November 28, 2025
Vulnerability identifier: #VU22449
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16278
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error in the "http_verify" function when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Note: This vulnerability leads to remote code execution.
Affected software
nostromo nhttpd
How to mitigate CVE-2019-16278
Install updates from vendor's website.
nostromo nhttpd - update to 1.9.7
Links to Public Exploits and PoC-codes
- Exploit #12147 - CVE-2019-16278 (RCE exploit for Nostromo nhttpd ≤ 1.9.6) (November 28, 2025)
- Exploit #10857 - CVE-2019-16278-Nostromo-1.9.6-RCE (This repository contains an exploit for CVE-2019-16278 in Nostromo Web Server 1.9.6, allowing remote code execution via a directory traversal vulnerability. The script uses pwntools to establish a reverse shell. For educ (November 15, 2024)
- Exploit #9049 - CVE-2019-16278-Nostromo-1.9.6-RCE (This is a exploit of CVE-2019-16278 for Nostromo 1.9.6 RCE. This exploit allows RCE on the victim machine.) (May 7, 2023)
- Exploit #5865 - Nostromo - Directory Traversal Remote Command Execution (Metasploit) (June 17, 2021)
- Exploit #5819 - nostromo 1.9.6 - Remote Code Execution (June 17, 2021)
- Exploit #2670 - CVE-2019-16278-Nostromo_1.9.6-RCE (Python script to exploit RCE in Nostromo nhttpd <= 1.9.6.) (May 15, 2020)
- Exploit #2250 - cve-2019-16278 (Exploit for the CVE-2019-16278 vulnerability) (April 1, 2020)
- Exploit #2045 - Nostromo_Python3 (CVE-2019-16278 Python3 Exploit Code) (March 18, 2020)
- Exploit #2061 - CVE-2019-16278 (A quick python exploit for the Nostromo 1.9.6 remote code execution vulnerability. Simply takes a host and port that the web server is running on. ) (March 18, 2020)
- Exploit #2063 - CVE-2019-16278-Nostromo_1.9.6-RCE (Python script to exploit RCE in Nostromo nhttpd <= 1.9.6.) (March 18, 2020)
- Exploit #1505 - Nostromo Directory Traversal Remote Command Execution (March 18, 2020)