Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Apache HTTP Server Allows Access to Sensitive Files

CVE-2017-16095 · published 8 years ago
Summary

Apache HTTP Server allows attackers to access sensitive files by manipulating the URL with '../' characters. This means an attacker could potentially access and view files on the server that they shouldn't have access to. To fix this issue, update your Apache HTTP Server software to the latest version or apply the recommended patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
npm liujiayi serverliujiayi1 >= 0.0.0
– serverliujiayi1_project serverliujiayi1 All versions
cpe:2.3:a:serverliujiayi1_project:serverliujiayi1:*:*:*:*:*:node.js:*:*
Original advisory text
serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published7 Jun 2018
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-vhx6-cp8w-295m · GHSA
CVE-2017-16095 · NVD
Track software like this
Free during beta