DEBIAN-CVE-2020-27304

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2020-27304
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-27304.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2020-27304
Upstream
Published
2021-10-21T16:15:07.737Z
Modified
2026-03-17T02:46:09.087206Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mghandleform_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal

References

Affected packages

Debian:11 / civetweb

Package

Name
civetweb
Purl
pkg:deb/debian/civetweb?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.13+dfsg-5
1.15+dfsg-1
1.15+dfsg-2
1.15+dfsg-3
1.15+dfsg-4
1.16+dfsg-1
1.16+dfsg-2
1.16+dfsg-3
1.16+dfsg-4

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-27304.json"

Debian:12 / civetweb

Package

Name
civetweb
Purl
pkg:deb/debian/civetweb?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.15+dfsg-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-27304.json"

Debian:13 / civetweb

Package

Name
civetweb
Purl
pkg:deb/debian/civetweb?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.15+dfsg-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-27304.json"

Debian:14 / civetweb

Package

Name
civetweb
Purl
pkg:deb/debian/civetweb?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.15+dfsg-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-27304.json"