Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

FormHandler.cgi script can expose any file on server

CVE-1999-1050 · published 26 years ago
Summary

The FormHandler.cgi script used in Matt Wright's form handling can be tricked into revealing files stored on the web server. An attacker can include special characters in a request to make the script read files it shouldn’t, potentially exposing sensitive information. Update or replace the script with a version that validates file paths, or apply a web‑application firewall rule to block such requests.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
matt_wright formhandler.cgi 1.0
2.0
3.0
cpe:2.3:a:matt_wright:formhandler.cgi:1.0:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the reply_message_attach attachment parameter, or (...
Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the reply_message_attach attachment parameter, or (2) by specifying the filename as a template.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
8% chance of attack within 30 days
Timeline
Published12 Nov 1999
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-1999-1050 · NVD
Track software like this
Free during beta