Skip to content

CVE-2011-2524

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows...

5.0 MediumFix available

CVE-2011-2524 is a medium vulnerability (CVSS 5.0) in Gnome Libsoup, published August 31, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 79th percentile. Fixed in libsoup2.4 2.34.3-1.

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Exploit likelihood

1.93%Up 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Record: CVE-2011-2524
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Record: CVE-2011-2524
Updated: 2026-11-02

EUVDEUVD-2011-2509 No score

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Record: EUVD-2011-2509
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xm6g-x36q-hxpx No score

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows...

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Record: GHSA-xm6g-x36q-hxpx
Weakness: CWE-22
Updated: 2026-11-02

OSV No score

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Record: CVE-2011-2524
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-2524 No score

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Record: DEBIAN-CVE-2011-2524
Updated: 2026-11-02

Affected products

gnome libsoup

Affected packages

Affected packages
Package	Affected	Fixed
`libsoup2.4` Debian:12	before 2.34.3-1	2.34.3-1
`libsoup2.4` Debian:13	before 2.34.3-1	2.34.3-1
`libsoup2.4` Debian:6.0	before 2.30.2-1+squeeze1, plus listed versions 2.30.2-1	2.30.2-1+squeeze1
`libsoup2.4` Debian:5.0	before 2.4.1-2+lenny1, plus listed versions 2.4.1-2	2.4.1-2+lenny1
`libsoup` Red Hat:enterprise_linux:6::server	before 0:2.28.2-1.el6_1.1	0:2.28.2-1.el6_1.1
`libsoup-debuginfo` Red Hat:enterprise_linux:6::server	before 0:2.28.2-1.el6_1.1	0:2.28.2-1.el6_1.1
`libsoup-devel` Red Hat:enterprise_linux:6::server	before 0:2.28.2-1.el6_1.1	0:2.28.2-1.el6_1.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 11 moreShow less