Directory Traversal Vulnerability in CivetWeb Web Library
CVE-2020-27304

9.8CRITICAL

Key Information:

Vendor: Civetweb Project
Status: Civetweb
Vendor: CVE Published:; 21 October 2021

🔔 Create Civetweb Project Vulnerability Alert

What is CVE-2020-27304?

The CivetWeb web library allows for a directory traversal vulnerability when handling file uploads with the mg_handle_form_request API on non-Windows operating systems. This occurs because the library does not validate the file paths of uploaded files, leaving web applications that utilize this file upload mechanism vulnerable. With the ability to manipulate the output path using user-controlled filename components, an attacker can potentially access unauthorized files within the server's directory structure.