Description
The (1) cgiwrap and (2) php-cgiwrap packages before 3.9 in Debian GNU/Linux provide access to debugging CGIs under the web document root, which allows remote attackers to obtain sensitive information via direct requests to those CGIs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | cgiwrap | 3.9-3.0etch1 | DTSA-6-1 |
Advisories 1
- DTSA-6-1 cgiwrap - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026