uWSGI Directory Traversal vulnerability

HIGH 7.5CVE-2018-7490 · GHSA-h2vm-c85r-5vh5 · PYSEC-2018-78 · Published 26/02/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
uwsgi PyPI	`< 2.0.17`	`2.0.17`
uwsgi unbit	`< 2.0.17`	`2.0.17`

Description

uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.

NVD description

uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.