{"id":"CVE-2018-11798","aliases":["CLSA-2026-1772756024","DEBIAN-CVE-2018-11798","EUVD-2019-0195","GHSA-vx85-mj8c-4qm6"],"status":"published","title":"Apache Thrift Node.js static web server sandbox escape","description":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04709,"percentile":0.91881,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-538"],"published":"2019-01-07T17:29:00.283Z","modified":"2026-10-24T10:30:27Z","fixes":[{"ecosystem":"Maven","package":"org.apache.thrift:libthrift","fixed_in":["0.12.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"thrift","fixed_in":["0.11.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thrift","fixed_in":["0.11.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thrift","fixed_in":["0.11.0-4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.thrift:libthrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.2"},{"fixed":"0.12.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.thrift:libfb303","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.3"},{"fixed":"0.9.3-tuxcare.2"}]}],"versions":["0.9.3","0.9.3.tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.thrift:libthrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.3"},{"fixed":"0.9.3-tuxcare.2"}]}],"versions":["0.9.3","0.9.3.tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.thrift:libthrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.2"},{"fixed":"0.12.0"}]}],"versions":["0.10.0","0.11.0","0.9.2","0.9.3","0.9.3-1"]}],"products":[{"vendor":"apache","product":"thrift"},{"vendor":"apache software foundation","product":"apache thrift"}],"references":[{"url":"http://www.securityfocus.com/bid/106501","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd%40%3Cuser.thrift.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1545","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3140","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11798","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vx85-mj8c-4qm6","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd@%3Cuser.thrift.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/thrift/pull/1606","tags":["web"]},{"url":"https://github.com/apache/thrift/commit/2a2b72f6c8aef200ecee4984f011e06052288ff2","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/THRIFT-4647","tags":["web"]},{"url":"https://web.archive.org/web/20200227094236/http://www.securityfocus.com/bid/106501","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-11798","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-11798","description":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.","status":"published","published":"2019-01-07T18:00:00Z","modified":"2024-08-05T08:17:09.238Z","updated_at":"2026-11-02T14:35:09.570381Z"}],"euvd":[{"id":"EUVD-2019-0195","description":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.","status":"published","published":"2019-01-07T18:00:00Z","modified":"2024-08-05T08:17:09Z","updated_at":"2026-11-03T02:39:54.130594Z"}],"ghsa":[{"id":"GHSA-vx85-mj8c-4qm6","title":"Apache Thrift Node.js static web server sandbox escape","description":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.","status":"published","published":"2019-01-17T13:56:33Z","modified":"2023-09-11T18:30:29Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-538"],"updated_at":"2026-11-02T14:37:03.916765Z"}],"nvd":[{"id":"CVE-2018-11798","description":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.","status":"published","published":"2019-01-07T17:29:00.283Z","modified":"2026-06-17T01:36:37.21Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-538"],"updated_at":"2026-11-02T14:04:52.056758Z"}],"osv":[{"id":"CVE-2018-11798","description":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.","status":"published","published":"2019-01-07T17:29:00.283Z","modified":"2026-10-24T10:30:27.929621126Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-11798","description":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.","status":"published","published":"2019-01-07T17:29:00.283Z","modified":"2026-10-23T18:03:47.423822973Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"GHSA-vx85-mj8c-4qm6","title":"Apache Thrift Node.js static web server sandbox escape","description":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.","status":"published","published":"2019-01-17T13:56:33Z","modified":"2026-09-10T03:47:58.933589138Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-538"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"CLSA-2026-1772756024","title":"TuxCare security update for org.apache.thrift (4 CVEs)","description":"TuxCare rebuilt 2 org.apache.thrift packages to address 4 CVEs. Fixed in 0.9.3-tuxcare.2.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:46:16.694320961Z","updated_at":"2026-11-02T15:43:43.249928Z"}]}}