CVE-2018-14056: Path Traversal
ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zncto a version that resolves this vulnerability.Fixed in 1.7.2-3Fixed in 1.8.2-2Fixed in 1.8.2-3.1 - Upgrade
Upgrade
alpine/zncto a version that resolves this vulnerability.Fixed in 1.7.1-r0
Event History
Frequently Asked Questions
What is CVE-2018-14056?
CVE-2018-14056 is a vulnerability in ZNC before 1.7.1-rc1 that allows path traversal via ../ in a web skin name to access files outside the intended directories.
How severe is CVE-2018-14056?
CVE-2018-14056 has a severity rating of medium, with a CVSS score of 5.3.
Which software versions are affected by CVE-2018-14056?
ZNC versions before 1.7.1-rc1 are affected by CVE-2018-14056.
How can I fix CVE-2018-14056?
To fix CVE-2018-14056, update ZNC to version 1.7.1-rc1 or later.
Where can I find more information about CVE-2018-14056?
You can find more information about CVE-2018-14056 in the following references: [link1], [link2], [link3].