CVE-1999-1377

Medium

Published: 09/09/1999(UTC)Updated: 16/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.08%

79th percentile - higher than 79% of all known CVEs

Summary

The vulnerability in download.cgi version 1.0 allows remote attackers to read arbitrary files by exploiting the .. (dot dot) sequence in the f parameter.

Risk Assessment

Attackers may gain access to sensitive data on the server, potentially leading to privacy breaches and security issues for the organization.

Recommendation

It is recommended to update the download.cgi script to the latest version and implement appropriate security measures to block access to system files.

Original NVD description (English source)

Matt Wright's download.cgi 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.