XAMPP Installer uncontrolled search path
Priority HIGH 67CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.
Summary
A vulnerability was found in XAMPP 7.1.1-0-VC14. It has been classified as problematic. Affected is an unknown function of the component Installer. The manipulation leads to privilege escalation. It is possible to launch the attack remotely.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00635 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| unspecified | XAMPP | 7.1.1-0-VC14 | — | No fix listed | CNA |
- XAMPP Vendorunspecified Affected 7.1.1-0-VC14 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apachefriends:xampp:7.1.1-0-vc14:*:*:*:*:*:*:* | 7.1.1-0-vc14 | Vulnerable | Apachefriends |
- cpe:2.3:a:apachefriends:xampp:7.1.1-0-vc14:*:*:*:*:*:*:* Versions 7.1.1-0-vc14 Vulnerable ·Apachefriends
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-20018
- 2026-10-03 Alias added: GHSA-63vx-4gcw-7q7w
- 2026-10-29 EPSS moved to the 50th–90th percentile
References
More Apachefriends Xampp vulnerabilities
- TI-2020-08980 An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before… CVSS 3.1HIGH 8.8
- TI-2019-06436 XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. CVSS 3.0CRITICAL 9.8
- TI-2009-00873 XAMPP installs multiple packages with insecure default passwords, which makes it easier… CVSS 2.0HIGH 7.5
- TI-2024-00306 Buffer Overflow Vulnerability in XAMPP CVSS 3.1CRITICAL 9.8
- TI-2022-11861 Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its… CVSS 3.1HIGH 8.8
- TI-2019-06437 XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. CVSS 3.0MEDIUM 6.1
Sources
- CVE-2017-20018 · CVE Program
- CVE-2017-20018 · NVD
- FIRST EPSS
- GHSA-63vx-4gcw-7q7w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences