CVE-2019-16278

Confirmed PUBLISHED

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted...

nostromo · nhttpd

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 99.1%

At a Glance

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.

cisa nessus_scanner metasploit nuclei_scanner

CVE Published: Oct 14, 2019
Exploitation Reported: Nov 07, 2024
CVSS: 9.8 Critical
EPSS: 99.1%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
nazgul	nostromo_nhttpd	0 to <= 1.9.6	Affected
n/a	n/a	n/a	Affected

CVE References

nazgul.ch/dev/nostromo_cl.txt nazgul.ch · CVE Record http://www.nazgul.ch/dev/nostromo_cl.txt
sp0re.sh sp0re.sh · CVE Record https://sp0re.sh
git.sp0re.sh/sp0re/Nhttpd-exploits git.sp0re.sh · CVE Record https://git.sp0re.sh/sp0re/Nhttpd-exploits
packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traver... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-...
packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Exec... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Cod...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2024-11-07 00:00 UTC
The Shadowserver	2026-07-08 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16278.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/nostromo_code_exec.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2024-11-07 00:00:00 UTC · CISA

Proof of concept available

Recorded 2019-10-15 03:40:13 UTC · GitHub

Weaknesses (CWE)

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/nostromo_code_exec.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16278.yaml	Apr 25, 2025
Nessus	https://www.tenable.com/plugins/nessus/142137	Nov 13, 2024

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

alexander-fernandes/CVE-2019-16278

github · Created 2022-03-24 12:06:55 UTC · 0 stars

A quick python exploit for the Nostromo 1.9.6 remote code execution vulnerability. Only takes in host and port of web server as required arguments.

n3rdh4x0r/CVE-2019-16278

github · Created 2021-07-19 00:45:07 UTC · 0 stars

NHPT/CVE-2019-16278

github · Created 2020-01-01 13:28:40 UTC · 0 stars

CVE-2019-16278：Nostromo Web服务器的RCE漏洞

aN0mad/CVE-2019-16278-Nostromo_1.9.6-RCE

github · Created 2019-11-26 14:15:44 UTC · 6 stars

Python script to exploit RCE in Nostromo nhttpd <= 1.9.6.

AnubisSec/CVE-2019-16278

github · Created 2019-11-22 18:35:14 UTC · 8 stars

A quick python exploit for the Nostromo 1.9.6 remote code execution vulnerability. Simply takes a host and port that the web server is running on.

ianxtianxt/CVE-2019-16278

github · Created 2019-10-15 12:47:59 UTC · 2 stars

CVE-2019-16278Nostromo httpd命令执行

imjdl/CVE-2019-16278-PoC

github · Created 2019-10-15 09:22:36 UTC · 8 stars

CVE-2019-16728 Proof of Concept

jas502n/CVE-2019-16278

github · Created 2019-10-15 03:40:13 UTC · 69 stars

Directory transversal to remote code execution

nostromo 1.9.6 - Remote Code Execution

nuclei · Created Unknown

nostromo_code_exec

metasploit · Created Unknown

Metasploit module for CVE-2019-16278

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

8 Jul 2026 00:00 UTC 14 days ago

8 Jul 2026 00:00 UTC · 14 days ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
13 Nov 2024 15:50 UTC over 1 year ago

13 Nov 2024 15:50 UTC · over 1 year ago

Nessus plugin available

Scanner coverage available
7 Nov 2024 00:00 UTC over 1 year ago

7 Nov 2024 00:00 UTC · over 1 year ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
15 Oct 2019 03:40 UTC almost 7 years ago

15 Oct 2019 03:40 UTC · almost 7 years ago

Public PoC available

Public proof-of-concept code published
14 Oct 2019 16:06 UTC almost 7 years ago

14 Oct 2019 16:06 UTC · almost 7 years ago

CVE published

Vulnerability disclosed publicly
13 Sep 2019 00:00 UTC almost 7 years ago

13 Sep 2019 00:00 UTC · almost 7 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2019-16278

{
  "cve_id": "CVE-2019-16278",
  "title": "Directory Traversal in the function http_verify in nostromo nhttpd through 1....",
  "affected_vendor": "nostromo",
  "affected_product": "nhttpd",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99057,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2019-16278

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API