Description
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | awstats | 6.5-2 | — |
| Debian 13 | awstats | 6.5-2 | — |
| Debian 12 | awstats | 6.5-2 | — |
| Debian 3.1 | awstats | 6.4-1sarge3 | DSA-1075-1 |
Advisories 1
- DSA-1075-1 awstats - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20710 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=365910
- 20502 third-party-advisory
- 20164 third-party-advisory
- http://www.osreviews.net/reviews/comm/awstats
- ADV-2006-1998 vdb-entry
- 18327 vdb-entry
- DSA-1075 vendor-advisory
- 20283 third-party-advisory
- USN-290-1 vendor-advisory
- SUSE-SA:2006:033 vendor-advisory