CVE-2018-7490
uWSGI Directory Traversal vulnerability
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
CVE-2018-7490- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
CVE-2018-7490- Updated
- 2026-11-02
EUVDEUVD-2018-0145 No score
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
EUVD-2018-0145- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h2vm-c85r-5vh5
uWSGI Directory Traversal vulnerability
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
GHSA-h2vm-c85r-5vh5- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVALPINE-CVE-2018-7490
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
ALPINE-CVE-2018-7490- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
CVE-2018-7490- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2018-7490
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
DEBIAN-CVE-2018-7490- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-h2vm-c85r-5vh5
uWSGI Directory Traversal vulnerability
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
GHSA-h2vm-c85r-5vh5- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-7490
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
UBUNTU-CVE-2018-7490- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVPYSEC-2018-78 No score
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
- Record
PYSEC-2018-78- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uwsgiPyPI |
before 2.0.17 | 2.0.17 |
uwsgiAlpine:v3.4 |
before 2.0.17-r0 | 2.0.17-r0 |
uwsgiAlpine:v3.5 |
before 2.0.17-r0 | 2.0.17-r0 |
uwsgiAlpine:v3.6 |
before 2.0.17-r0 | 2.0.17-r0 |
uwsgiAlpine:v3.7 |
before 2.0.17-r0 | 2.0.17-r0 |
uwsgiDebian:12 |
before 2.0.15-10.4 | 2.0.15-10.4 |
uwsgiDebian:13 |
before 2.0.15-10.4 | 2.0.15-10.4 |
uwsgiDebian:14 |
before 2.0.15-10.4 | 2.0.15-10.4 |
uwsgiDebian:8 |
before 2.0.7-1+deb8u2, plus listed versions 2.0.7-12.0.7-1+deb8u1 |
2.0.7-1+deb8u2 |
uwsgiDebian:9 |
before 2.0.14+20161117-3+deb9u2, plus listed versions 2.0.14+20161117-32.0.14+20161117-3+deb9u1 |
2.0.14+20161117-3+deb9u2 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
uwsgiPyPI |
before 2.0.17, plus listed versions 1.4.101.4.91.91.9.11.9.10 Show 44 moreShow less1.9.111.9.121.9.131.9.141.9.151.9.161.9.171.9.17.11.9.181.9.18.11.9.18.21.9.191.9.21.9.201.9.211.9.21.11.9.31.9.41.9.51.9.61.9.71.9.81.9.92.02.0.12.0.102.0.112.0.11.12.0.11.22.0.122.0.132.0.13.12.0.142.0.152.0.162.0.22.0.32.0.42.0.52.0.5.12.0.62.0.72.0.82.0.9 |
2.0.17 |
uwsgiUbuntu:14.04:LTS |
before 1.9.17.1-5ubuntu0.1, plus listed versions 1.9.13-4build11.9.17.1-51.9.17.1-5build21.9.17.1-5build41.9.17.1-5build5 |
1.9.17.1-5ubuntu0.1 |
uwsgiUbuntu:16.04:LTS |
before 2.0.12-5ubuntu3.2, plus listed versions 2.0.7-1ubuntu52.0.7-1ubuntu62.0.11.2-6ubuntu12.0.11.2-6ubuntu22.0.12-4ubuntu2 Show 4 moreShow less2.0.12-5ubuntu12.0.12-5ubuntu22.0.12-5ubuntu32.0.12-5ubuntu3.1 |
2.0.12-5ubuntu3.2 |
uwsgiUbuntu:18.04:LTS |
before 2.0.15-10.2ubuntu2.1, plus listed versions 2.0.15-2.1ubuntu22.0.15-2.1ubuntu32.0.15-102.0.15-10.12.0.15-10.1build12.0.15-10.1build22.0.15-10.22.0.15-10.2ubuntu2 |
2.0.15-10.2ubuntu2.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | uWSGI < 2.0.17 - Directory Traversal | 2018-03-02 |
| Nuclei | uWSGI PHP Plugin Local File Inclusion | |
| PoC in GitHub | CyberCTF/vulhub-uwsgi-cve-2018-7490 | 2026-10-08 |
| PoC in GitHub | qinzhu111/uWSGI-CVE-2018-7490-POC | 2024-06-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7490 is a high vulnerability (CVSS 7.5) in Unbit Uwsgi, published February 26, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 69.4%, the 99th percentile. Fixed in uwsgi 2.0.17.
References
exploit-db.com/exploits/44223
debian.org/security/2018/dsa-4142
uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html
nvd.nist.gov/vuln/detail/CVE-2018-7490
github.com/unbit/uwsgi/commit/0a480f435ea6feb63deb410ad2bf376ed3f05f8a