{"id":"CVE-2018-14056","details":"ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.","modified":"2026-07-08T17:15:28.286046Z","published":"2018-07-15T01:29:03.633Z","related":["openSUSE-SU-2024:11542-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201807-03"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4252"},{"type":"FIX","url":"https://github.com/znc/znc/commit/a4a5aeeb17d32937d8c7d743dae9a4cc755ce773"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/znc/znc","events":[{"introduced":"0"},{"last_affected":"4489b1b69474cb5ffa1b2d5c9b19b725e7e59e04"},{"fixed":"a4a5aeeb17d32937d8c7d743dae9a4cc755ce773"}],"database_specific":{"cpe":"cpe:2.3:a:znc:znc:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.7.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["znc-1.7.0","znc-1.6.0","znc-1.2","znc-1.0","znc-0.200","znc-0.098","znc-0.096","znc-0.094","znc-0.072","znc-0.070","znc-0.068","znc-0.066","znc-0.064","znc-0.062","znc-0.060","znc-0.058","znc-0.056","znc-0.054","znc-0.054-rc3","znc-0.054-rc2","znc-0.054-rc1","znc-0.052","znc-0.050","znc-0.047","znc-0.045","znc-0.044","znc-0.043","znc-0.041","znc-0.040","znc-0.039","znc-0.038","znc-0.037","znc-0.036","znc-0.035","znc-0.034","znc-0.033","znc-0.030","znc-0.029","znc-0.028","znc-0.027","znc-0.025","znc-0.023"],"database_specific":{"vanir_signatures_modified":"2026-07-08T17:15:28Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/znc/znc/commit/a4a5aeeb17d32937d8c7d743dae9a4cc755ce773","target":{"file":"src/WebModules.cpp","function":"CWebSock::GetSkinPath"},"deprecated":false,"digest":{"function_hash":"230239668005739726547415841134892702946","length":324},"id":"CVE-2018-14056-520b6c12"},{"digest":{"line_hashes":["317629045933835914814329189593651256713","232453281137543700062677396828761595611","95850806842429227230092879311385366203","16706244423504679049760187812381908990","154665892332439519549797513188972957449","319273650834360086546577451806642157682","292119683161844694741004784656480862389","5762613768222406744701999058322446306"],"threshold":0.9},"id":"CVE-2018-14056-7ffe5bc2","signature_type":"Line","signature_version":"v1","source":"https://github.com/znc/znc/commit/a4a5aeeb17d32937d8c7d743dae9a4cc755ce773","target":{"file":"src/WebModules.cpp"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14056.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}