{"id":"CVE-2020-29600","aliases":["ALPINE-CVE-2020-29600","DEBIAN-CVE-2020-29600","DLA-2506-1","EUVD-2020-21961","GHSA-43g3-5cf8-2gm2","MGASA-2021-0024","UBUNTU-CVE-2020-29600","USN-4953-1"],"status":"published","title":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it...","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03836,"percentile":0.90252,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2020-12-07T19:52:14Z","modified":"2026-10-26T12:02:48Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"awstats","fixed_in":["7.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"awstats","fixed_in":["7.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"awstats","fixed_in":["7.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"awstats","fixed_in":["7.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"awstats","fixed_in":["7.8-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"awstats","fixed_in":["7.7-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"awstats","fixed_in":["7.4+dfsg-1ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"awstats","fixed_in":["7.6+dfsg-2ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"awstats","fixed_in":["7.6+dfsg-2ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6+dfsg-1+deb9u2"}]}],"versions":["7.6+dfsg-1","7.6+dfsg-1+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4+dfsg-1ubuntu0.4+esm1"}]}],"versions":["7.4+dfsg-1","7.4+dfsg-1ubuntu0.1","7.4+dfsg-1ubuntu0.2","7.4+dfsg-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6+dfsg-2ubuntu0.18.04.1"}]}],"versions":["7.6+dfsg-1","7.6+dfsg-1ubuntu2","7.6+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6+dfsg-2ubuntu0.20.04.1"}]}],"versions":["7.6+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4+dfsg-1ubuntu0.4+esm1"}]}],"versions":["7.4+dfsg-1","7.4+dfsg-1ubuntu0.1","7.4+dfsg-1ubuntu0.2","7.4+dfsg-1ubuntu0.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6+dfsg-2ubuntu0.18.04.1"}]}],"versions":["7.6+dfsg-1","7.6+dfsg-1ubuntu2","7.6+dfsg-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"awstats","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6+dfsg-2ubuntu0.20.04.1"}]}],"versions":["7.6+dfsg-2"],"bundled":3}],"products":[{"vendor":"awstats","product":"awstats"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/eldy/awstats/issues/90","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891469","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Mailing List","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00035.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47QZWKSRZYZFESYTLSW7A6KVKOOPL7IV/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29600"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/47QZWKSRZYZFESYTLSW7A6KVKOOPL7IV/"},{"url":"https://github.com/advisories/GHSA-43g3-5cf8-2gm2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-29600","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-29600","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0024.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27920","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2506","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/47QZWKSRZYZFESYTLSW7A6KVKOOPL7IV/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-29600","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4953-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-29600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35176","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-29600","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","status":"published","published":"2020-12-07T19:52:14Z","modified":"2024-08-04T16:55:10.624Z","updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2020-21961","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","status":"published","published":"2020-12-07T19:52:14Z","modified":"2024-08-04T16:55:10Z","updated_at":"2026-11-03T03:07:07.463834Z"}],"ghsa":[{"id":"GHSA-43g3-5cf8-2gm2","title":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it...","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","status":"published","published":"2022-05-24T17:35:26Z","modified":"2023-01-29T05:04:51Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:45:39.24589Z"}],"nvd":[{"id":"CVE-2020-29600","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","status":"published","published":"2020-12-07T20:15:12.837Z","modified":"2026-06-17T03:11:30.32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"ALPINE-CVE-2020-29600","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","status":"published","published":"2020-12-07T20:15:12.837Z","modified":"2026-10-26T11:17:55.170763815Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-29600","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","status":"published","published":"2020-12-07T20:15:12.837Z","modified":"2026-10-20T10:53:15.665016663Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-29600","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","status":"published","published":"2020-12-07T20:15:12.837Z","modified":"2026-10-26T12:02:48.875440248Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-29600","description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","status":"published","published":"2020-12-07T20:15:00Z","modified":"2026-02-04T04:13:23.655659Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-2506-1","title":"awstats - security update","status":"published","published":"2020-12-23T00:00:00Z","modified":"2026-03-09T01:22:28.933095Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0024","title":"Updated awstats package fixes a security vulnerability","description":"It was discovered that Awstats was vulnerable to path traversal attacks. A\nremote unauthenticated attacker could leverage that to perform arbitrary code\nexecution. The previous fix did not fully address the issue when the default\n/etc/awstats/awstats.conf is not present (CVE-2020-29600).\n","status":"published","published":"2021-01-14T15:13:25Z","modified":"2026-04-16T04:41:16.340468381Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"USN-4953-1","title":"awstats vulnerabilities","description":"Sean Boran discovered that AWStats incorrectly filtered certain parameters.\nA remote attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-29600)\n\nIt was discovered that AWStats incorrectly filtered certain parameters. A\nremote attacker could possibly use this issue to access sensitive\ninformation. (CVE-2020-35176)\n","status":"published","published":"2021-05-13T17:12:49Z","modified":"2026-06-25T13:30:36.183329569Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}