CVE catalog

CVE-2018-7490

uwsgi: CVE-2018-7490

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
69.42% · Oct 22, 2026

uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianuwsgisid2.0.31-6fixed
Debianuwsgiforky2.0.31-6fixed
Debianuwsgitrixie2.0.28-9fixed
Debianuwsgibookworm2.0.21-5.1fixed
Ubuntuuwsgi14.041.9.13-4build1vulnerable
Ubuntuuwsgi14.041.9.17.1-5vulnerable
Ubuntuuwsgi14.041.9.17.1-5build2vulnerable
Ubuntuuwsgi14.041.9.17.1-5build4vulnerable
Ubuntuuwsgi14.041.9.17.1-5build5vulnerable
Ubuntuuwsgi14.041.9.17.1-5ubuntu0.1fixed
Ubuntuuwsgi16.042.0.7-1ubuntu5vulnerable
Ubuntuuwsgi16.042.0.7-1ubuntu6vulnerable
Ubuntuuwsgi16.042.0.11.2-6ubuntu1vulnerable
Ubuntuuwsgi16.042.0.11.2-6ubuntu2vulnerable
Ubuntuuwsgi16.042.0.12-4ubuntu2vulnerable
Ubuntuuwsgi16.042.0.12-5ubuntu1vulnerable
Ubuntuuwsgi16.042.0.12-5ubuntu2vulnerable
Ubuntuuwsgi16.042.0.12-5ubuntu3vulnerable
Ubuntuuwsgi16.042.0.12-5ubuntu3.1vulnerable
Ubuntuuwsgi16.042.0.12-5ubuntu3.2fixed
Ubuntuuwsgi18.042.0.15-2.1ubuntu2vulnerable
Ubuntuuwsgi18.042.0.15-2.1ubuntu3vulnerable
Ubuntuuwsgi18.042.0.15-10vulnerable
Ubuntuuwsgi18.042.0.15-10.1vulnerable
Ubuntuuwsgi18.042.0.15-10.1build1vulnerable
Ubuntuuwsgi18.042.0.15-10.1build2vulnerable
Ubuntuuwsgi18.042.0.15-10.2vulnerable
Ubuntuuwsgi18.042.0.15-10.2ubuntu2vulnerable
Ubuntuuwsgi18.042.0.15-10.2ubuntu2.1fixed
Alpineuwsgi3.41.3-r0vulnerable
Alpineuwsgi3.41.4.2-r0vulnerable
Alpineuwsgi3.41.4.3-r0vulnerable
Alpineuwsgi3.41.4.3-r1vulnerable
Alpineuwsgi3.41.4.8-r0vulnerable
Alpineuwsgi3.41.4.8-r1vulnerable
Alpineuwsgi3.41.4.8-r2vulnerable
Alpineuwsgi3.41.4.8-r3vulnerable
Alpineuwsgi3.41.9.15-r0vulnerable
Alpineuwsgi3.41.9.20-r0vulnerable
Alpineuwsgi3.41.9.20-r1vulnerable
Alpineuwsgi3.41.9.20-r2vulnerable
Alpineuwsgi3.41.9.20-r3vulnerable
Alpineuwsgi3.41.9.20-r4vulnerable
Alpineuwsgi3.42.0-r0vulnerable
Alpineuwsgi3.42.0.1-r0vulnerable
Alpineuwsgi3.42.0.1-r1vulnerable
Alpineuwsgi3.42.0.10-r0vulnerable
Alpineuwsgi3.42.0.10-r1vulnerable
Alpineuwsgi3.42.0.11.1-r0vulnerable
Alpineuwsgi3.42.0.11.2-r0vulnerable
Alpineuwsgi3.42.0.11.2-r1vulnerable
Alpineuwsgi3.42.0.12-r0vulnerable
Alpineuwsgi3.42.0.13-r0vulnerable
Alpineuwsgi3.42.0.3-r0vulnerable
Alpineuwsgi3.42.0.3-r1vulnerable
Alpineuwsgi3.42.0.4-r0vulnerable
Alpineuwsgi3.42.0.4-r1vulnerable
Alpineuwsgi3.42.0.5.1-r0vulnerable
Alpineuwsgi3.42.0.6-r0vulnerable
Alpineuwsgi3.42.0.7-r0vulnerable
Alpineuwsgi3.42.0.8-r0vulnerable
Alpineuwsgi3.42.0.9-r0vulnerable
Alpineuwsgi3.42.0.9-r1vulnerable
Alpineuwsgi3.42.0.9-r2vulnerable
Alpineuwsgi3.42.0.17-r0fixed
Alpineuwsgi3.51.3-r0vulnerable
Alpineuwsgi3.51.4.2-r0vulnerable
Alpineuwsgi3.51.4.3-r0vulnerable
Alpineuwsgi3.51.4.3-r1vulnerable
Alpineuwsgi3.51.4.8-r0vulnerable
Alpineuwsgi3.51.4.8-r1vulnerable
Alpineuwsgi3.51.4.8-r2vulnerable
Alpineuwsgi3.51.4.8-r3vulnerable
Alpineuwsgi3.51.9.15-r0vulnerable
Alpineuwsgi3.51.9.20-r0vulnerable
Alpineuwsgi3.51.9.20-r1vulnerable
Alpineuwsgi3.51.9.20-r2vulnerable
Alpineuwsgi3.51.9.20-r3vulnerable
Alpineuwsgi3.51.9.20-r4vulnerable
Alpineuwsgi3.52.0-r0vulnerable
Alpineuwsgi3.52.0.1-r0vulnerable
Alpineuwsgi3.52.0.1-r1vulnerable
Alpineuwsgi3.52.0.10-r0vulnerable
Alpineuwsgi3.52.0.10-r1vulnerable
Alpineuwsgi3.52.0.11.1-r0vulnerable
Alpineuwsgi3.52.0.11.2-r0vulnerable
Alpineuwsgi3.52.0.11.2-r1vulnerable
Alpineuwsgi3.52.0.12-r0vulnerable
Alpineuwsgi3.52.0.13-r0vulnerable
Alpineuwsgi3.52.0.13.1-r0vulnerable
Alpineuwsgi3.52.0.13.1-r1vulnerable
Alpineuwsgi3.52.0.13.1-r2vulnerable
Alpineuwsgi3.52.0.13.1-r3vulnerable
Alpineuwsgi3.52.0.13.1-r4vulnerable
Alpineuwsgi3.52.0.13.1-r5vulnerable
Alpineuwsgi3.52.0.14-r0vulnerable
Alpineuwsgi3.52.0.14-r1vulnerable
Alpineuwsgi3.52.0.14-r2vulnerable
Alpineuwsgi3.52.0.14-r3vulnerable
Alpineuwsgi3.52.0.14-r4vulnerable
Alpineuwsgi3.52.0.3-r0vulnerable
Alpineuwsgi3.52.0.3-r1vulnerable
Alpineuwsgi3.52.0.4-r0vulnerable
Alpineuwsgi3.52.0.4-r1vulnerable
Alpineuwsgi3.52.0.5.1-r0vulnerable
Alpineuwsgi3.52.0.6-r0vulnerable
Alpineuwsgi3.52.0.7-r0vulnerable
Alpineuwsgi3.52.0.8-r0vulnerable
Alpineuwsgi3.52.0.9-r0vulnerable
Alpineuwsgi3.52.0.9-r1vulnerable
Alpineuwsgi3.52.0.9-r2vulnerable
Alpineuwsgi3.52.0.17-r0fixed
Alpineuwsgi3.61.3-r0vulnerable
Alpineuwsgi3.61.4.2-r0vulnerable
Alpineuwsgi3.61.4.3-r0vulnerable
Alpineuwsgi3.61.4.3-r1vulnerable
Alpineuwsgi3.61.4.8-r0vulnerable
Alpineuwsgi3.61.4.8-r1vulnerable
Alpineuwsgi3.61.4.8-r2vulnerable
Alpineuwsgi3.61.4.8-r3vulnerable
Alpineuwsgi3.61.9.15-r0vulnerable
Alpineuwsgi3.61.9.20-r0vulnerable
Alpineuwsgi3.61.9.20-r1vulnerable
Alpineuwsgi3.61.9.20-r2vulnerable
Alpineuwsgi3.61.9.20-r3vulnerable
Alpineuwsgi3.61.9.20-r4vulnerable
Alpineuwsgi3.62.0-r0vulnerable
Alpineuwsgi3.62.0.1-r0vulnerable
Alpineuwsgi3.62.0.1-r1vulnerable
Alpineuwsgi3.62.0.10-r0vulnerable
Alpineuwsgi3.62.0.10-r1vulnerable
Alpineuwsgi3.62.0.11.1-r0vulnerable
Alpineuwsgi3.62.0.11.2-r0vulnerable
Alpineuwsgi3.62.0.11.2-r1vulnerable
Alpineuwsgi3.62.0.12-r0vulnerable
Alpineuwsgi3.62.0.13-r0vulnerable
Alpineuwsgi3.62.0.13.1-r0vulnerable
Alpineuwsgi3.62.0.13.1-r1vulnerable
Alpineuwsgi3.62.0.13.1-r2vulnerable
Alpineuwsgi3.62.0.13.1-r3vulnerable
Alpineuwsgi3.62.0.13.1-r4vulnerable
Alpineuwsgi3.62.0.13.1-r5vulnerable
Alpineuwsgi3.62.0.14-r0vulnerable
Alpineuwsgi3.62.0.14-r1vulnerable
Alpineuwsgi3.62.0.14-r2vulnerable
Alpineuwsgi3.62.0.14-r3vulnerable
Alpineuwsgi3.62.0.14-r4vulnerable
Alpineuwsgi3.62.0.14-r5vulnerable
Alpineuwsgi3.62.0.14-r6vulnerable
Alpineuwsgi3.62.0.14-r7vulnerable
Alpineuwsgi3.62.0.14-r8vulnerable
Alpineuwsgi3.62.0.14-r9vulnerable
Alpineuwsgi3.62.0.3-r0vulnerable
Alpineuwsgi3.62.0.3-r1vulnerable
Alpineuwsgi3.62.0.4-r0vulnerable
Alpineuwsgi3.62.0.4-r1vulnerable
Alpineuwsgi3.62.0.5.1-r0vulnerable
Alpineuwsgi3.62.0.6-r0vulnerable
Alpineuwsgi3.62.0.7-r0vulnerable
Alpineuwsgi3.62.0.8-r0vulnerable
Alpineuwsgi3.62.0.9-r0vulnerable
Alpineuwsgi3.62.0.9-r1vulnerable
Alpineuwsgi3.62.0.9-r2vulnerable
Alpineuwsgi3.62.0.17-r0fixed
Alpineuwsgi3.71.3-r0vulnerable
Alpineuwsgi3.71.4.2-r0vulnerable
Alpineuwsgi3.71.4.3-r0vulnerable
Alpineuwsgi3.71.4.3-r1vulnerable
Alpineuwsgi3.71.4.8-r0vulnerable
Alpineuwsgi3.71.4.8-r1vulnerable
Alpineuwsgi3.71.4.8-r2vulnerable
Alpineuwsgi3.71.4.8-r3vulnerable
Alpineuwsgi3.71.9.15-r0vulnerable
Alpineuwsgi3.71.9.20-r0vulnerable
Alpineuwsgi3.71.9.20-r1vulnerable
Alpineuwsgi3.71.9.20-r2vulnerable
Alpineuwsgi3.71.9.20-r3vulnerable
Alpineuwsgi3.71.9.20-r4vulnerable
Alpineuwsgi3.72.0-r0vulnerable
Alpineuwsgi3.72.0.1-r0vulnerable
Alpineuwsgi3.72.0.1-r1vulnerable
Alpineuwsgi3.72.0.10-r0vulnerable
Alpineuwsgi3.72.0.10-r1vulnerable
Alpineuwsgi3.72.0.11.1-r0vulnerable
Alpineuwsgi3.72.0.11.2-r0vulnerable
Alpineuwsgi3.72.0.11.2-r1vulnerable
Alpineuwsgi3.72.0.12-r0vulnerable
Alpineuwsgi3.72.0.13-r0vulnerable
Alpineuwsgi3.72.0.13.1-r0vulnerable
Alpineuwsgi3.72.0.13.1-r1vulnerable
Alpineuwsgi3.72.0.13.1-r2vulnerable
Alpineuwsgi3.72.0.13.1-r3vulnerable
Alpineuwsgi3.72.0.13.1-r4vulnerable
Alpineuwsgi3.72.0.13.1-r5vulnerable
Alpineuwsgi3.72.0.14-r0vulnerable
Alpineuwsgi3.72.0.14-r1vulnerable
Alpineuwsgi3.72.0.14-r2vulnerable
Alpineuwsgi3.72.0.14-r3vulnerable
Alpineuwsgi3.72.0.14-r4vulnerable
Alpineuwsgi3.72.0.14-r5vulnerable
Alpineuwsgi3.72.0.14-r6vulnerable
Alpineuwsgi3.72.0.14-r7vulnerable
Alpineuwsgi3.72.0.14-r8vulnerable
Alpineuwsgi3.72.0.14-r9vulnerable
Alpineuwsgi3.72.0.15-r0vulnerable
Alpineuwsgi3.72.0.15-r1vulnerable
Alpineuwsgi3.72.0.16-r0vulnerable
Alpineuwsgi3.72.0.3-r0vulnerable
Alpineuwsgi3.72.0.3-r1vulnerable
Alpineuwsgi3.72.0.4-r0vulnerable
Alpineuwsgi3.72.0.4-r1vulnerable
Alpineuwsgi3.72.0.5.1-r0vulnerable
Alpineuwsgi3.72.0.6-r0vulnerable
Alpineuwsgi3.72.0.7-r0vulnerable
Alpineuwsgi3.72.0.8-r0vulnerable
Alpineuwsgi3.72.0.9-r0vulnerable
Alpineuwsgi3.72.0.9-r1vulnerable
Alpineuwsgi3.72.0.9-r2vulnerable
Alpineuwsgi3.72.0.17-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianuwsgisourcesid2.0.15-10.4not yet assignedNot reported[891639]
Debianuwsgisourceforky2.0.15-10.4not yet assignedNot reported[891639]
Debianuwsgisourcetrixie2.0.15-10.4not yet assignedNot reported[891639]
Debianuwsgisourcebookworm2.0.15-10.4not yet assignedNot reported[891639]
Ubuntuuwsgideb14.041.9.17.1-5ubuntu0.1Not reportedUBUNTU-CVE-2018-7490Not reported
Ubuntuuwsgideb16.042.0.12-5ubuntu3.2Not reportedUBUNTU-CVE-2018-7490Not reported
Ubuntuuwsgideb18.042.0.15-10.2ubuntu2.1Not reportedUBUNTU-CVE-2018-7490Not reported
Alpineuwsgiapk3.42.0.17-r0Not reportedALPINE-CVE-2018-7490Not reported
Alpineuwsgiapk3.52.0.17-r0Not reportedALPINE-CVE-2018-7490Not reported
Alpineuwsgiapk3.62.0.17-r0Not reportedALPINE-CVE-2018-7490Not reported
Alpineuwsgiapk3.72.0.17-r0Not reportedALPINE-CVE-2018-7490Not reported

[Debian bug #891639]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · all · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · all · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • [uwsgi]Fixed
    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • [uwsgi-core]Fixed

    Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • [uwsgi-dbg]Fixed

    Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • [uwsgi-dev]Fixed

    Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · all · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · all · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

  • Source package: [uwsgi]

    Details (2)
    • 2.0.21-5.1 · amd64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

    • 2.0.21-5.1 · arm64 · bookworm

      Fixed · Fixed: 2.0.15-10.4

      dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

Next results

Observed:

References