Directory traversal vulnerability in xweb 1.0 allows remote attackers to download arbitrary files via a .. (dot dot) in the URL.

1. 2004-03-22 First public exploit (EDB-23864)
2. 2004-03-22 Published

3.74% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

• EDB-23864 xweb 1.0 - Directory Traversal remote, 2004-03-22
• autistici.org http://www.autistici.org/fdonato/advisory/xweb1.0-adv.txt referenced PoC, tagged "exploit" by a source, unverified
• secunia.com http://secunia.com/advisories/11186 referenced PoC, tagged "exploit" by a source, unverified
• securityfocus.com http://www.securityfocus.com/bid/9937 referenced PoC, tagged "exploit" by a source, unverified
• securitytracker.com http://securitytracker.com/id?1009514 referenced PoC, tagged "exploit" by a source, unverified

• autistici.org /fdonato/advisory/xweb1.0-adv.txt

  exploit, patch, vendor-advisory

• secunia.com /advisories/11186

  third-party-advisory, exploit, patch, vendor-advisory

• securityfocus.com /bid/9937

  vdb-entry, exploit, patch, vendor-advisory

• securitytracker.com /id?1009514

  vdb-entry, exploit, patch, vendor-advisory

• osvdb.org /4460

  vdb-entry, vendor-advisory

• marc.info /?l=bugtraq&m=107997946623770&w=2

  mailing-list

• exchange.xforce.ibmcloud.com /vulnerabilities/15567

  vdb-entry

• CVE List CVE-2004-1838
• NVD CVE-2004-1838

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.