GCVE - cpe:2.3:a:civetweb_project:civetweb:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:civetweb_project:civetweb:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Civetweb Project (`2a89396c-ad0f-5281-823f-a01931734e98`)
Product	Civetweb (`7935e773-f957-50df-a035-c13e1674fe2f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/civetweb`	purl2cpe	2026-06-01 10:14:42.547745
`pkg:deb/ubuntu/civetweb`	purl2cpe	2026-06-01 10:14:42.547748
`pkg:github/civetweb/civetweb`	purl2cpe	2026-06-01 10:14:42.547751
`pkg:rpm/opensuse/civetweb`	purl2cpe	2026-06-01 10:14:42.547753
`pkg:sourceforge/civetweb`	purl2cpe	2026-06-01 10:14:42.547756

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-55763`	vulnerable	2026-06-08 07:33:15.351972	Details available Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution. Published: 2025-08-29T00:00:00.000Z Updated: 2025-08-29T17:05:30.204Z Open on db.gcve.eu Reference links https://github.com/civetweb/civetweb https://github.com/krispybyte/CVE-2025-55763	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-27304`	vulnerable	2026-06-08 05:23:52.574536	Details available The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal Published: 2021-10-21T15:42:23.000Z Updated: 2024-08-04T16:11:36.691Z Open on db.gcve.eu Reference links https://jfrog.com/blog/cve-2020-27304-rce-via-directory-traversal-in-civetweb-http-server/ https://groups.google.com/g/civetweb/c/yPBxNXdGgJQ https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-27304`	not_vulnerable	2026-06-08 05:23:52.574483	Details available The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal Published: 2021-10-21T15:42:23.000Z Updated: 2024-08-04T16:11:36.691Z Open on db.gcve.eu Reference links https://jfrog.com/blog/cve-2020-27304-rce-via-directory-traversal-in-civetweb-http-server/ https://groups.google.com/g/civetweb/c/yPBxNXdGgJQ https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-12684`	vulnerable	2026-06-08 05:10:41.882051	Details available Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file. Published: 2018-06-22T19:00:00.000Z Updated: 2024-09-17T01:20:45.883Z Open on db.gcve.eu Reference links https://github.com/civetweb/civetweb/issues/633 https://github.com/civetweb/civetweb/commit/8fd069f6dedb064339f1091069ac96f3f8bdb552	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Civetweb

Notes

PURL mappings

Vulnerability references

Contribute