CVE-2018-19052: Debian Linux

High severity, CVSS 7.5. EPSS: 13.7% chance of exploitation in the next 30 days.

An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

Affected products

• Debian Debian Linux: version 9.0 only
• Lighttpd Lighttpd: before 1.4.50 (fixed in 1.4.50)
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.0 only; version 15.1 only
• Suse Suse Linux Enterprise Server: version 11 only; version 12 only

Published 2018-11-07. Last modified 2026-06-17.