{"id":"CVE-2019-8358","aliases":["EUVD-2019-17748","GHSA-wj8m-8jfq-gg4x","MGASA-2019-0112","openSUSE-SU-2019:0294-1","openSUSE-SU-2019:0322-1"],"status":"published","title":"In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles...","description":"In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01499,"percentile":0.74475,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2019-02-16T18:00:00Z","modified":"2026-06-17T02:41:53Z","fixes":[{"ecosystem":"Mageia:6","package":"hiawatha","fixed_in":["10.8.4-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"hiawatha","fixed_in":["10.8.4-bp150.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:6","package":"hiawatha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.8.4-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"hiawatha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.8.4-bp150.3.3.1"}]}]}],"products":[{"vendor":"hiawatha-webserver","product":"hiawatha"}],"references":[{"url":"https://www.hiawatha-webserver.org/changelog","tags":["x_refsource_CONFIRM","x_transferred","Product","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8358"},{"url":"https://github.com/advisories/GHSA-wj8m-8jfq-gg4x"},{"url":"https://advisories.mageia.org/MGASA-2019-0112.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24481","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-03/msg00022.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GRQA2OAAAZ2KWLGW64L6JGJYFSXJFXVL/#GRQA2OAAAZ2KWLGW64L6JGJYFSXJFXVL","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125751","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8358","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KK62HFIQDUPOHLYUOMKFMBKWFUFL3ZIQ/#KK62HFIQDUPOHLYUOMKFMBKWFUFL3ZIQ","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-8358","description":"In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.","status":"published","published":"2019-02-16T18:00:00Z","modified":"2024-09-16T17:59:07.887Z","updated_at":"2026-11-02T14:20:22.019351Z"}],"euvd":[{"id":"EUVD-2019-17748","description":"In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.","status":"published","published":"2019-02-16T18:00:00Z","modified":"2024-09-16T17:59:07Z","updated_at":"2026-11-03T00:55:36.806318Z"}],"ghsa":[{"id":"GHSA-wj8m-8jfq-gg4x","title":"In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles...","description":"In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.","status":"published","published":"2022-05-14T01:33:38Z","modified":"2023-02-02T05:04:03Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:51:46.878809Z"}],"nvd":[{"id":"CVE-2019-8358","description":"In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.","status":"published","published":"2019-02-16T18:29:00.217Z","modified":"2026-06-17T02:41:53.667Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"MGASA-2019-0112","title":"Updated hiawatha packages fix security vulnerability","description":"Verison 10.8.4 fixed a vulnerability which allowed a remote atacker to\nperform directory traversal when AllowDotFiles was enabled\n(CVE-2019-8358).\n","status":"published","published":"2019-03-14T21:39:55Z","modified":"2026-04-16T04:41:49.623982693Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0294-1","title":"Security update for hiawatha","description":"This update for hiawatha to version 10.8.4 fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2019-8358: Fixed a vulnerability which allowed a remote atacker to perform directory traversal \n  when AllowDotFiles was enabled (bsc#1125751).\n    \n","status":"published","published":"2019-03-23T11:09:39Z","modified":"2026-02-04T02:37:25.830302Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0322-1","title":"Security update for hiawatha","description":"This update for hiawatha to version 10.8.4 fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2019-8358: Fixed a vulnerability which allowed a remote atacker to perform directory traversal \n  when AllowDotFiles was enabled (bsc#1125751).\n    \n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-03-09T13:08:17Z","modified":"2026-02-04T02:18:17.69194Z","updated_at":"2026-11-02T16:58:30.39372Z"}]}}