CVE-2020-27304: Path Traversal
A remote code execution vulnerability was found in CivetWeb (embeddable web server/library). Due to a directory traversal issue, an attacker is able to add or overwrite files that are subsequently executed which lead to impact to confidentiality, integrity, and availability of the application.
Other sources
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mghandleformrequest API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-27304?
CVE-2020-27304 is a remote code execution vulnerability found in CivetWeb (embeddable web server/library).
How does CVE-2020-27304 work?
CVE-2020-27304 allows an attacker to execute arbitrary code by not validating uploaded filepaths when using the built-in HTTP form-based file upload mechanism.
What is the severity of CVE-2020-27304?
CVE-2020-27304 has a severity rating of 9.8 (Critical).
Which software is affected by CVE-2020-27304?
CivetWeb version 1.15 and earlier, Civetweb Project Civetweb version 1.8 to 1.15, and Siemens Sinec Infrastructure Network Services version 1.0.1.1 are affected by CVE-2020-27304.
How can I remediate CVE-2020-27304?
Apply the recommended remedy of updating to CivetWeb version 1.15.