CVE-2020-35176: Awstats

Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days.

In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.

Affected products

• Awstats Awstats: up to and including 7.8
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only; version 33 only

Published 2020-12-12. Last modified 2026-06-17.