Unrated
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file u...
CVE-2020-27304
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2020-27304 civetweb Fixed in: 1.15+dfsg-1
- Ubuntu UBUNTU-CVE-2020-27304 civetweb
Original description The description as published by the source.
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal
References
- advisory groups.google.com
- patch cert-portal.siemens.com
- report jfrog.com
- web cert-portal.siemens.com