{"action":"Upgrade civetweb to 1.15+dfsg-1 or later.","affected":[{"fixed":"1.15+dfsg-1","introduced":"0"}],"component":"civetweb","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["1.15+dfsg-1"],"id":"tcs_01M5NEY0JARAQJJ2WACPC4SZHQ","modified_at":"2026-10-26T12:02:42.518961967Z","published_at":"2021-10-21T16:15:07.737Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-27304","https://security-tracker.debian.org/tracker/CVE-2020-27304"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-27304","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-27304"}],"summary":"The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request AP"}