CVE-1999-1456

Medium

Published: 31/12/1999(UTC)Updated: 16/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.71%

74th percentile - higher than 74% of all known CVEs

Summary

thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename.

Risk Assessment

Attackers may gain access to sensitive data on the server, potentially leading to serious security breaches.

Recommendation

It is recommended to update the thttpd server to the latest version to mitigate this vulnerability.

Original NVD description (English source)

thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename.