Vulnerability · Published Oct 21, 2021 · Assigned by VDOO

CVE-2020-27304

Critical 9.8

In plain English

A critical-severity security flaw in civetweb from civetweb_project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)3.3%top 11.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	civetweb	1.15+dfsg-1	DEBIAN-CVE-2020-27304
Debian:13	civetweb	1.15+dfsg-1	DEBIAN-CVE-2020-27304
Debian:14	civetweb	1.15+dfsg-1	DEBIAN-CVE-2020-27304
Ubuntu:25.10	civetweb	no fix listed	UBUNTU-CVE-2020-27304

Affected products (as reported)

Vendor	Product	Versions
civetweb_project	civetweb	1.8 – before unspecified

Weakness: CWE-23

References

https://jfrog.com/blog/cve-2020-27304-rce-via-directory-traversal-in-civetweb-http-server/ x_refsource_MISC
https://groups.google.com/g/civetweb/c/yPBxNXdGgJQ x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf x_refsource_CONFIRM