CVE-2020-29600: Awstats

Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days.

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.

Affected products

• Awstats Awstats: up to and including 7.7
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only

Published 2020-12-07. Last modified 2026-06-17.