CVE-2019-8358: Hiawatha-Webserver Hiawatha

High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days.

In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.

Affected products

• Hiawatha-Webserver Hiawatha: before 10.8.4 (fixed in 10.8.4)

Published 2019-02-16. Last modified 2026-06-17.