{"id":"CVE-2018-19052","details":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","modified":"2026-07-08T16:40:19.271812Z","published":"2018-11-07T05:29:00.343Z","related":["openSUSE-SU-2019:2347-1","openSUSE-SU-2024:10585-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*","cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0-NA"},{"last_affected":"15.0-NA"},{"introduced":"15.0-sp1"},{"last_affected":"15.0-sp1"}],"source":"CPE_STRING","vendor_product":"opensuse:backports_sle"},{"cpes":["cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"15.1"},{"last_affected":"15.1"}],"source":"CPE_STRING","vendor_product":"opensuse:leap"},{"source":"CPE_STRING","vendor_product":"suse:suse_linux_enterprise_server","cpes":["cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:*:*:*","cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp4:*:*:*:*:*:*","cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*","cpe:2.3:o:suse:suse_linux_enterprise_server:12:sp1:*:*:*:*:*:*","cpe:2.3:o:suse:suse_linux_enterprise_server:12:sp2:*:*:*:*:*:*","cpe:2.3:o:suse:suse_linux_enterprise_server:12:sp3:*:*:*:*:*:*","cpe:2.3:o:suse:suse_linux_enterprise_server:12:sp4:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11-sp3"},{"last_affected":"11-sp3"},{"introduced":"11-sp4"},{"last_affected":"11-sp4"},{"introduced":"12"},{"last_affected":"12"},{"introduced":"12-sp1"},{"last_affected":"12-sp1"},{"introduced":"12-sp2"},{"last_affected":"12-sp2"},{"introduced":"12-sp3"},{"last_affected":"12-sp3"},{"introduced":"12-sp4"},{"last_affected":"12-sp4"}]}]},"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00012.html"},{"type":"EVIDENCE","url":"https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lighttpd/lighttpd1.4","events":[{"introduced":"0"},{"fixed":"a2114a1c9b34a165cf69439e21a5d1429e252554"},{"fixed":"2105dae0f9d7a964375ce681e53cb165375f84c1"}],"database_specific":{"cpe":"cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.4.50"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["lighttpd-1.4.49","lighttpd-1.4.48","lighttpd-1.4.47","lighttpd-1.4.46","lighttpd-1.4.45","lighttpd-1.4.44","lighttpd-1.4.43","lighttpd-1.4.42","lighttpd-1.4.41","lighttpd-1.4.40","lighttpd-1.4.39","lighttpd-1.4.38","lighttpd-1.4.37","lighttpd-1.4.36","lighttpd-1.4.36--rc1","lighttpd-1.4.35","lighttpd-1.4.34","lighttpd-1.4.33","lighttpd-1.4.32","lighttpd-1.4.31","lighttpd-1.4.30","lighttpd-1.4.29","lighttpd-1.4.28","lighttpd-1.4.27","lighttpd-1.4.26","lighttpd-1.4.25","lighttpd-1.4.7","lighttpd-1.4.6","lighttpd-1.4.5","lighttpd-1.4.4","lighttpd-1.4.3","lighttpd-1.4.2","lighttpd-1.4.1","lighttpd-1.3.16","lighttpd-1.3.15","lighttpd-1.3.14","lighttpd-1.3.13","lighttpd-1.3.12","lighttpd-1.3.11"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"149042138735570835025939466017948242542","length":1029},"id":"CVE-2018-19052-1be13382","signature_type":"Function","signature_version":"v1","source":"https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1","target":{"file":"src/mod_alias.c","function":"PHYSICALPATH_FUNC"}},{"digest":{"line_hashes":["303192333452448327106390395563064620760","80679466272643474847981161116281953383","208143731090529638039435268477316973998"],"threshold":0.9},"id":"CVE-2018-19052-387c5170","signature_type":"Line","signature_version":"v1","source":"https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1","target":{"file":"src/mod_alias.c"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19052.json","vanir_signatures_modified":"2026-07-08T16:40:19Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}