What’s Vulnerable › Vulnerabilities
CVE-2018-19052
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 13.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2018-11-07 · updated 2026-06-17
- Weakness: CWE-22
Description
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
Affected products
- Debian Linux: 9.0
- lighttpd: before 1.4.50 — fixed in 1.4.50
- openSUSE Backports Sle: 15.0, 15.0-sp1
- openSUSE Leap: 15.0, 15.1
- SUSE Linux Enterprise: 11-sp3, 11-sp4, 12, 12-sp1, 12-sp2, 12-sp3 (+1)
How to fix
Upgrade to a fixed version: lighttpd 1.4.50. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.html
- https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1
- https://lists.debian.org/debian-lts-announce/2022/01/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.html
- https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1
- https://lists.debian.org/debian-lts-announce/2022/01/msg00012.html
Get alerted when CVE-2018-19052 or the next vulnerability affects your stack