Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2020-27304

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_ha

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VDOO

Description

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

civetweb_project civetweb

  • 1.15 to < unspecifiedunaffected
  • 1.8 to < unspecifiedaffected

References