Civetweb Project: >> Civetweb Security Vulnerabilities
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal
CVSS Score
9.8
EPSS Score
0.006
Published
2021-10-21
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
CVSS Score
7.1
EPSS Score
0.002
Published
2018-06-22