CVE-2020-27304

2021-10-2115:42:23

CWE-23

VDOO

www.cve.org

civetweb

directory traversal

http file upload

AI Score

9.5

Confidence

High

EPSS

0.004

Percentile

75.2%

JSON

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal

CNA Affected

[
  {
    "product": "civetweb",
    "vendor": "civetweb_project",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "1.15",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "1.8",
        "versionType": "custom"
      }
    ]
  }
]