{"id":"CVE-2020-29050","aliases":["DEBIAN-CVE-2020-29050","DLA-2882-1","DSA-5036-1","EUVD-2020-21432","GHSA-4g2j-rgw2-wmrw","MGASA-2022-0110","OESA-2022-1496","UBUNTU-CVE-2020-29050","openSUSE-SU-2022:0046-1","openSUSE-SU-2022:0054-1","openSUSE-SU-2024:11787-1"],"status":"published","title":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in...","description":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02238,"percentile":0.82939,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-01-06T00:00:00Z","modified":"2026-10-26T12:02:24Z","fixes":[{"ecosystem":"Debian:12","package":"sphinxsearch","fixed_in":["2.2.11-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sphinxsearch","fixed_in":["2.2.11-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sphinxsearch","fixed_in":["2.2.11-3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"sphinxsearch","fixed_in":["2.2.11-1.1+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"sphinxsearch","fixed_in":["2.2.11-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"sphinx","fixed_in":["2.3.2-0.beta.3.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"sphinx","fixed_in":["2.2.11-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"sphinx","fixed_in":["2.2.11-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"sphinx","fixed_in":["2.2.11-2.oe1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"sphinx","fixed_in":["2.2.11-lp154.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"sphinx","fixed_in":["2.2.11-lp153.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-1.1+deb9u1"}]}],"versions":["2.2.11-1.1"]},{"source":"osv","ecosystem":"Debian:10","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-2+deb10u1"}]}],"versions":["2.2.11-2"]},{"source":"osv","ecosystem":"Mageia:8","package":"sphinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-0.beta.3.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"sphinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"sphinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"sphinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-2.oe1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-1.1ubuntu2","2.2.9-1","2.2.9-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2build1","2.2.11-2ubuntu1","2.2.11-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2ubuntu2","2.2.11-8"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"sphinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-lp154.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"sphinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-lp153.2.3.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"sphinxsearch","product":"sphinx"}],"references":[{"url":"https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-29050","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29050","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4g2j-rgw2-wmrw"},{"url":"https://advisories.mageia.org/MGASA-2022-0110.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30076","tags":["report"]},{"url":"https://www.debian.org/security/2022/dsa-5036","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BGIIYJ6U7AIFKGIYHMGJHVDPJF5AWYOA/","tags":["web","advisory"]},{"url":"https://salsa.debian.org/debian/sphinxsearch/-/blob/4d6fe40644130308604845db43d3588e715ec85d/debian/patches/06-CVE-2020-29050.patch","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1496","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-29050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-29050","tags":["report"]},{"url":"https://bugzilla.suse.com/1195227","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29050","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H2Z7YY7HZ2IKSH75SHSRUFT5AJHJJOLN/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157590","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-29050","description":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.","status":"published","published":"2022-01-07T06:02:39Z","modified":"2024-08-04T16:48:01.488Z","updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2020-21432","description":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.","status":"published","published":"2022-01-07T06:02:39Z","modified":"2024-08-04T16:48:01Z","updated_at":"2026-11-03T03:07:08.475588Z"}],"ghsa":[{"id":"GHSA-4g2j-rgw2-wmrw","title":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in...","description":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.","status":"published","published":"2022-01-11T00:01:42Z","modified":"2023-02-03T05:04:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:53:31.323466Z"}],"nvd":[{"id":"CVE-2020-29050","description":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.","status":"published","published":"2022-01-10T14:10:16.077Z","modified":"2026-06-17T03:11:01.483Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:46.101987Z"}],"osv":[{"id":"CVE-2020-29050","description":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.","status":"published","published":"2022-01-10T14:10:16.077Z","modified":"2026-04-16T04:30:29.007236512Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-29050","description":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.","status":"published","published":"2022-01-10T14:10:16.077Z","modified":"2026-10-26T12:02:24.431544484Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"OESA-2022-1496","title":"sphinx security update","description":"Sphinx is a full-text search engine, distributed under GPL version 2. Commercial licensing (e.g. for embedded use) is also available upon request. Generally, it\u0026apos;s a standalone search engine, meant to provide fast, size-efficient and relevant full-text search functions to other applications. Sphinx was specially designed to integrate well with SQL databases and scripting languages. Currently built-in data source drivers support fetching data either via direct connection to MySQL, or PostgreSQL, or from a pipe in a custom XML format. Adding new drivers (e.g. native support other DBMSes) is designed to be as easy as possible. Search API native ported to PHP, Python, Perl, Ruby, Java, and also available as a plug-gable MySQL storage engine. API is very lightweight so porting it to new language is known to take a few hours. As for the name, Sphinx is an acronym which is officially decoded as SQL Phrase Index. Yes, I know about CMU\u0026apos;s Sphinx project.\r\n\r\nSecurity Fix(es):\r\n\r\nSphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.(CVE-2020-29050)","status":"published","published":"2022-01-22T11:04:46Z","modified":"2026-08-18T01:16:23.332710641Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-29050","description":"SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.","status":"published","published":"2022-01-10T14:10:00Z","modified":"2025-10-24T04:48:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-2882-1","title":"sphinxsearch - security update","status":"published","published":"2022-01-17T00:00:00Z","modified":"2026-03-09T01:22:12.1053Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5036-1","title":"sphinxsearch - security update","status":"published","published":"2022-01-06T00:00:00Z","modified":"2026-03-09T02:10:16.521104Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0110","title":"Updated sphinx packages fix security vulnerability","description":"It was found that sphinx could allow arbitrary files to be read by abusing\na configuration option. (CVE-2020-29050)\n","status":"published","published":"2022-03-23T08:36:28Z","modified":"2026-04-16T04:44:46.655507319Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0046-1","title":"Security update for sphinx","description":"\nsphinx was updated to fix the following issues:\n\n- CVE-2020-29050: SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory\n  traversal (in conjunction with CVE-2019-14511) because the mysql client can be\n  used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file\n  in the /etc directory). (boo#1195227)\n","status":"published","published":"2022-02-20T13:01:33Z","modified":"2026-02-04T04:23:32.302235Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0054-1","title":"Security update for sphinx","description":"This update for sphinx fixes the following issues:\n\n- CVE-2020-29050: SphinxSearch in Sphinx Technologies Sphinx allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). (boo#1195227)\n- update to 2.0.6 release","status":"published","published":"2022-03-01T14:49:20Z","modified":"2026-02-04T02:59:12.34977Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11787-1","title":"libsphinxclient-0_0_1-2.2.11-6.1 on GA media","description":"These are all security issues fixed in the libsphinxclient-0_0_1-2.2.11-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:12:58.375262Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}