CVE-2016-6255
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files...
CVE-2016-6255 is a high vulnerability (CVSS 7.5) in Libupnp Project Libupnp, published July 26, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 27.0%, the 98th percentile. Fixed in libupnp 1:1.6.17-1.2+deb7u1.
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
- Record
CVE-2016-6255- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
- Record
CVE-2016-6255- Updated
- 2026-11-02
EUVDEUVD-2016-7185 No score
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
- Record
EUVD-2016-7185- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cpx4-fhhq-52jh
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files...
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
- Record
GHSA-cpx4-fhhq-52jh- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
- Record
CVE-2016-6255- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-6255
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
- Record
UBUNTU-CVE-2016-6255- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0266 No score
Updated libupnp packages fix security vulnerability
libupnp's default behavior allows an unauthenticated user access to a server's filesystem through POST and GET requests (CVE-2016-6255).
- Record
MGASA-2016-0266- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11006-1 No score
libixml11-1.14.10-1.2 on GA media
These are all security issues fixed in the libixml11-1.14.10-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11006-1- Updated
- 2026-11-02
OSVUSN-4794-1 No score
libupnp vulnerabilities
Matthew Garrett discovered that libupnp mishandled POST requests by default. An attacker could use this vulnerability to write files to arbitrary locations in the victim's filesystem, possibly as root. (CVE-2016-6255)
It was discovered that libupnp mishandled certain input. A remote attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. (CVE-2016-8863)
- Record
USN-4794-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libupnpDebian:7 |
before 1:1.6.17-1.2+deb7u1, plus listed versions 1:1.6.17-1.2 |
1:1.6.17-1.2+deb7u1 |
libupnpDebian:8 |
before 1:1.6.19+git20141001-1+deb8u1, plus listed versions 1:1.6.19+git20141001-1 |
1:1.6.19+git20141001-1+deb8u1 |
libupnpMageia:5 |
before 1.6.19-4.1.mga5 | 1.6.19-4.1.mga5 |
libupnpUbuntu:14.04:LTS |
before 1:1.6.17-1.2+deb7u1build0.14.04.1, plus listed versions 1:1.6.17-1.2 |
1:1.6.17-1.2+deb7u1build0.14.04.1 |
libupnpUbuntu:Pro:16.04:LTS |
before 1:1.6.19+git20160116-1ubuntu0.1~esm1, plus listed versions 1:1.6.19+git20141001-11:1.6.19+git20141001-1ubuntu11:1.6.19+git20160116-1 |
1:1.6.19+git20160116-1ubuntu0.1~esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MiCasaVerde VeraLite - Remote Code Execution | 2016-10-20 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2016/07/20/5
twitter.com/mjg59/status/755062278513319936
github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbd
sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLog
security.gentoo.org/glsa/201701-52
exploit-db.com/exploits/40589
Show 16 moreShow less
tenable.com/security/research/tra-2017-10
debian.org/security/2016/dsa-3736
securityfocus.com/bid/92050
nvd.nist.gov/vuln/detail/CVE-2016-6255
advisories.mageia.org/MGASA-2016-0266.html
bugs.mageia.org/show_bug.cgi?id=19008
ubuntu.com/security/CVE-2016-6255
cve.org/CVERecord?id=CVE-2016-6255
suse.com/security/cve/CVE-2016-6255