CVE-2020-27304

CVE-2020-27304 relates to CivetWeb’s form-based file upload handling: when running on non-Windows OS, uploaded file paths are not validated, enabling directory traversal if a web app uses user-controlled filename segments in output paths. Public sources in connected docs tie this to Siemens SCALA...

CVE-2025-55763

A buffer overflow vulnerability exists in the URI parser of CivetWeb 1.14 through 1.16 (latest) . The root cause is located in src/civetweb.c during a strcat operation, which allows a remote attacker to corrupt heap memory via a crafted HTTP request. This can lead to a denial of service or remote...

CVE-2026-5789

CVE-2026-5789 affects CivetWeb v1.16. The root cause is an unquoted search path in the service configuration, allowing a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory scanned before the application path (e.g., C:\Program Files\C...

CVE-2018-12684

CivetWeb up to version 1.10 contains an out-of-bounds read in the send_ssi_file function (civetweb.c) that allows an attacker to cause a Denial of Service or Information Disclosure via a crafted SSI file. The CVE description specifies affected software and root cause; no explicit exploit details ...