{"id":"CVE-2018-19052","aliases":["DEBIAN-CVE-2018-19052","DLA-2887-1","EUVD-2018-10769","GHSA-f959-jhqc-rqpv","UBUNTU-CVE-2018-19052","USN-4775-1","openSUSE-SU-2019:2347-1","openSUSE-SU-2024:10585-1"],"status":"published","title":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50....","description":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.13714,"percentile":0.96525,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2018-11-07T05:00:00Z","modified":"2026-10-23T18:03:03Z","exploits":[{"source":"pocgithub","id":"iveresk/cve-2018-19052","title":"iveresk/cve-2018-19052","date":"2022-07-15","url":"https://github.com/iveresk/cve-2018-19052"}],"fixes":[{"ecosystem":"Debian:12","package":"lighttpd","fixed_in":["1.4.52-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lighttpd","fixed_in":["1.4.52-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lighttpd","fixed_in":["1.4.52-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"lighttpd","fixed_in":["1.4.45-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lighttpd","fixed_in":["1.4.33-1+nmu2ubuntu2.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lighttpd","fixed_in":["1.4.35-4ubuntu2.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lighttpd","fixed_in":["1.4.45-1ubuntu3.18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"lighttpd","fixed_in":["1.4.54-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"lighttpd","fixed_in":["1.4.54-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"lighttpd","fixed_in":["1.4.54-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"lighttpd","fixed_in":["1.4.54-bp151.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.52-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.52-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.52-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.45-1+deb9u1"}]}],"versions":["1.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1+nmu2ubuntu2.1+esm1"}]}],"versions":["1.4.31-3ubuntu3","1.4.33-1ubuntu1","1.4.33-1+nmu2ubuntu1","1.4.33-1+nmu2ubuntu2","1.4.33-1+nmu2ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.35-4ubuntu2.1+esm1"}]}],"versions":["1.4.35-4ubuntu1","1.4.35-4ubuntu2","1.4.35-4ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.45-1ubuntu3.18.04.1+esm1"}]}],"versions":["1.4.45-1ubuntu1","1.4.45-1ubuntu3","1.4.45-1ubuntu3+esm1","1.4.45-1ubuntu3.18.04","1.4.45-1ubuntu3.18.04+esm1","1.4.45-1ubuntu3.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1+nmu2ubuntu2.1+esm1"}]}],"versions":["1.4.31-3ubuntu3","1.4.33-1ubuntu1","1.4.33-1+nmu2ubuntu1","1.4.33-1+nmu2ubuntu2","1.4.33-1+nmu2ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.35-4ubuntu2.1+esm1"}]}],"versions":["1.4.35-4ubuntu1","1.4.35-4ubuntu2","1.4.35-4ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.45-1ubuntu3.18.04.1+esm1"}]}],"versions":["1.4.45-1ubuntu1","1.4.45-1ubuntu3","1.4.45-1ubuntu3+esm1","1.4.45-1ubuntu3.18.04","1.4.45-1ubuntu3.18.04+esm1","1.4.45-1ubuntu3.18.04.1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.54-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.54-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.54-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.54-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.59-2.1"}]}],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"lighttpd","product":"lighttpd"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"suse","product":"suse_linux_enterprise_server"}],"references":[{"url":"https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00012.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19052"},{"url":"https://github.com/advisories/GHSA-f959-jhqc-rqpv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19052","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-19052","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4775-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3200","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VOBJZNTYGCVJJSLH5SFMUWQQJH3XPGJW/#VOBJZNTYGCVJJSLH5SFMUWQQJH3XPGJW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1087369","tags":["report"]},{"url":"https://bugzilla.suse.com/1111733","tags":["report"]},{"url":"https://bugzilla.suse.com/1115016","tags":["report"]},{"url":"https://bugzilla.suse.com/1153722","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19052","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4359","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-19052","description":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","status":"published","published":"2018-11-07T05:00:00Z","modified":"2024-08-05T11:30:04.022Z","updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2018-10769","description":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","status":"published","published":"2018-11-07T05:00:00Z","modified":"2024-08-05T11:30:04Z","updated_at":"2026-11-03T02:39:34.247095Z"}],"ghsa":[{"id":"GHSA-f959-jhqc-rqpv","title":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50....","description":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","status":"published","published":"2022-05-13T01:02:58Z","modified":"2023-02-01T05:02:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:49:56.179573Z"}],"nvd":[{"id":"CVE-2018-19052","description":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","status":"published","published":"2018-11-07T05:29:00.343Z","modified":"2026-06-17T01:48:41.95Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:47.196456Z"}],"osv":[{"id":"CVE-2018-19052","description":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","status":"published","published":"2018-11-07T05:29:00.343Z","modified":"2026-10-20T13:31:38.508931054Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-19052","description":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","status":"published","published":"2018-11-07T05:29:00.343Z","modified":"2026-10-23T18:03:03.20555713Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-19052","description":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","status":"published","published":"2018-11-07T05:29:00Z","modified":"2026-04-22T11:50:21.502921Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-2887-1","title":"lighttpd - security update","status":"published","published":"2022-01-18T00:00:00Z","modified":"2026-03-09T01:18:21.266127Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2019:2347-1","title":"Security update for lighttpd","description":"This update for lighttpd to version 1.4.54 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-19052: Fixed a path traversal in mod_alias (boo#1115016).\n- Changed the default TLS configuration of lighttpd for better security out-of-the-box (boo#1087369).\n","status":"published","published":"2019-10-20T17:22:17Z","modified":"2026-02-04T03:14:22.941991Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10585-1","title":"lighttpd-1.4.59-2.1 on GA media","description":"These are all security issues fixed in the lighttpd-1.4.59-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:09:20.173242Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4775-1","title":"lighttpd vulnerabilities","description":"It was discovered that Lighttpd did not properly sanitized the string used in\nbasic HTTP authentication method. A remote attacker could use this to inject\narbitrary log entries and maybe obtain sensitive information. This issue only\naffected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2015-3200)\n\nIt was discovered that Lighttpd did not properly sanitized the string used in\nalias. A remote attacker could use this to access the content of the directory\nabove the alias and obtain sensitive information. (CVE-2018-19052)\n","status":"published","published":"2021-03-15T20:50:13Z","modified":"2026-06-29T13:48:14.918479858Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}