CVE-1999-1456: Thttpd HTTP Server

Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days.

thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename.

Affected products

• Thttpd Thttpd HTTP Server: up to and including 2.03

Published 1999-12-31. Last modified 2026-06-16.