Description
Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbitrary files via .. (dot dot) sequences in the Host: header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | thttpd | 2.21b-11.2 | DSA-396 |
Advisories 1
- DSA-396 thttpd - missing input sanitizing, wrong calculation Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://news.php.net/article.php?group=php.cvs&article=15698
- http://marc.info/?l=thttpd&m=103609565110472&w=2
- DSA-396 vendor-advisory
- CLA-2003:777 vendor-advisory