CVE-2020-11819

CRITICAL ⚠ Exploit

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS26.8%
Percentile98th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-22: Path Traversal

Attacker manipulates file path inputs to access files outside the intended directory.

Related Attack Patterns (CAPEC)
CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
via CWE-22
CAPEC-76 Manipulating Web Input to File System Calls
via CWE-22
CAPEC-78 Using Escaped Slashes in Alternate Encoding
via CWE-22
CAPEC-79 Using Slashes in Alternate Encoding
via CWE-22
CAPEC-126 Path Traversal
via CWE-22

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in Rukovoditel 2.5.2 allows attackers to inject an arbitrary .php file location instead of a language file, leading to command execution.

BSID: BS-2020-GLOBAL-236064-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-11819?
A critical vulnerability in Rukovoditel 2.5.2 allows attackers to inject an arbitrary .php file location instead of a language file, leading to command execution.
What is the CVSS score for CVE-2020-11819?
CVE-2020-11819 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 26.8%.
Is CVE-2020-11819 actively exploited?
Public exploit available for CVE-2020-11819. Exploitation risk elevated.
How do I remediate CVE-2020-11819?
Priority: IMMEDIATE.
What systems are affected by CVE-2020-11819?
CVE-2020-11819 affects Rukovoditel Rukovoditel.
Vulnerability Details
CVE IDCVE-2020-11819
BSIDBS-2020-GLOBAL-236064-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2020-04-16
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Path Traversal
SourceNVD
Official Description

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper validation of file paths when loading language files. An attacker can manipulate the file path parameter to point to a malicious .php file hosted on a remote server or within the web root, which can then be executed on the server.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Rukovoditel Rukovoditel 2.5.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2373 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Rukovoditel
CVE-2020-11820 9.8 Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of imp... CVE-2020-11816 9.8 Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of imp... CVE-2020-11812 9.8 Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of imp... CVE-2020-11815 9.8 In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by ju... CVE-2020-11817 9.8 In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server j...
View all Rukovoditel CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →