Loading CVE intelligence

CVE-2019-16278

CriticalPublished

Nostromo nhttpd Directory Traversal Vulnerability

Published: Oct 14, 2019
Updated: Oct 21, 2025
Assigning CNA: mitre
Evidence observed: Nov 1, 2019

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

99.0%

High · next 30 days

Percentile: 99.9%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.

Sources

17

CVE-2019-16278Exploit
A quick python exploit for the Nostromo 1.9.6 remote code execution vulnerability. Only takes in host and port of web server as required arguments.
CVE-2019-16278-Nostromo_1.9.6-RCEExploit
Python script to exploit RCE in Nostromo nhttpd <= 1.9.6.
CVE-2019-16278Exploit
PoC RCE exploit for Nostromo nhttpd ≤ 1.9.6
CVE-2019-16278

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

Exploit

A quick python exploit for the Nostromo 1.9.6 remote code execution vulnerability. Simply takes a host and port that the web server is running on.

CVE-2019-16278-Nostromo-1.9.6-RCEExploit

Exploit for CVE-2019-16278 targeting Nostromo Web Server 1.9.6, achieving remote code execution via directory traversal. Uses pwntools to deliver a reverse shell payload. Intended for authorized testing and education.

CVE-2019-16278_Nostromo-1.9.6---Remote-Code-ExecutionExploit

An unauthenticated attacker can force server points to a shell file like ‘/bin/sh’ and execute arbitrary commands due to the failure in verifying the URL which leads to path traversal to any file that exists in the system. Nostromo’s versions such as 1.9.6 fail to verify this URL

Nostromo_Python3Exploit

CVE-2019-16278 Python3 Exploit Code

CVE-2019-16278-Nostromo-1.9.6-RCEExploit

This is a exploit of CVE-2019-16278 for Nostromo 1.9.6 RCE. This exploit allows RCE on the victim machine.

CVE-2019-16278Exploit

Python exploit script for CVE-2019-16278, achieving remote code execution on nostromo 1.9.6 web servers via a crafted HTTP request.

CVE-2019-16278Exploit

Directory transversal to remote code execution

cve-2019-16278Exploit

Exploit for the CVE-2019-16278 vulnerability

CVE-2019-16278Exploit

CVE-2019-16278：Nostromo Web服务器的RCE漏洞

CVE-2019-16278Exploit

Python exploit script for CVE-2019-16278, a remote command execution vulnerability in Nostromo httpd. Executes arbitrary commands on vulnerable servers via crafted HTTP requests.

CVE-2019-16278-PoCPoC

Proof-of-concept exploit for CVE-2019-16278 targeting Nhttpd directory traversal vulnerability. Enables remote file disclosure on affected servers for security testing and validation.

cve-2019-16278Exploit

(Nhttpd) Nostromo 1.9.6 RCE due to Directory Traversal

Nostromo - Directory Traversal Remote Command Execution (Metasploit)Exploit

Metasploit · multiple · Nov 1, 2019

nostromo 1.9.6 - Remote Code ExecutionExploit

Kr0ff · multiple · Jan 1, 2020