civetweb_project

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

civetweb_project records in CISA KEV

No civetweb_project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Civetweb 4 records HIGH

Records

4 records

TI-2025-35177 CVE-2025-55763 · GHSA-2757-2hpv-v482

Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote…

HIGH 66

Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01198 Published 2025-08-29 No fix listed CWE-121

TI-2020-16622 CVE-2020-27304 · GHSA-wphm-mh7c-38cf

Path traversal in civetweb_project civetweb

MEDIUM 48

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03268 Published 2021-10-21 Partial fix · 1.15 CWE-23

TI-2026-05070 CVE-2026-5789 · GHSA-9vxj-j2f7-9mgg

Search path without quotes in CivetWeb

LOW 38

Vulnerability related to an unquoted search path in CivetWeb v1.16.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00139 Published 2026-04-21 No fix listed CWE-428

TI-2018-09103 CVE-2018-12684 · GHSA-v8q9-6423-3jq2

Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10…

LOW 33

Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.

CVSS 3.0HIGH 7.1 Local No auth User interaction EPSS 0.01035 Published 2018-06-22 No fix listed CWE-125

Open these records in search →

Critical	1
High	3
Medium	0
Low	0
No CVSS	0