Description
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| civetweb_project | civetweb | 1.8 – < unspecified | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | civetweb | 1.15+dfsg-1 | — |
| Debian 13 | civetweb | 1.15+dfsg-1 | — |
| Debian 12 | civetweb | 1.15+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | civetweb | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | civetweb | 1.15-lp152.2.3.1 | openSUSE-SU-2021:1424-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ceph | 18.2.1-1 | — |
Advisories 5
- openSUSE-SU-2021:1424-1 Security update for civetweb SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-22-069-09 Siemens SINEC INS CISA ICS & IT advisories · May 6, 2025
- ICSA-22-167-09 Siemens SCALANCE LPE9403 Third-Party Vulnerabilities CISA ICS & IT advisories · Jun 14, 2022
- SSA-222547 SSA-222547: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0 Siemens ProductCERT · Jun 14, 2022
- SSA-389290 SSA-389290: Third-Party Component Vulnerabilities in SINEC INS Siemens ProductCERT · Mar 8, 2022