CVE-2004-2640 json
Directory traversal vulnerability in lstat.cgi in LinuxStat before 2.3.1 allows remote attackers to read arbitrary files via (1) .. (dot do…
published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-2631
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.1%
- EPSS 8.1% chance of exploitation in 30 days, percentile 94%
- public exploits
- 1
- Exploit-DB
Summary
Directory traversal vulnerability in lstat.cgi in LinuxStat before 2.3.1 allows remote attackers to read arbitrary files via (1) .. (dot dot) sequences or (2) absolute paths to the template parameter.
Patch / fix
- securityfocus.com/bid/11517 patch
- osvdb.org/11103 patch
- secunia.com/advisories/12963 advisory
Timeline
- First public exploit (EDB-24703)
- Published
Exploit prediction
8.12% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-24703 LinuxStat 2.x - Directory Traversal webapps, 2004-10-25
- securityfocus.com http://www.securityfocus.com/bid/11517 referenced PoC, tagged "exploit" by a source, unverified
- securitytracker.com http://securitytracker.com/id?1011920 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
-
securityfocus.com
/bid/11517
vdb-entry, exploit, patch
-
osvdb.org
/11103
vdb-entry, patch
-
secunia.com
/advisories/12963
third-party-advisory, patch, vendor-advisory
-
securitytracker.com
/id?1011920
vdb-entry, exploit
-
exchange.xforce.ibmcloud.com
/vulnerabilities/17833
vdb-entry
- sourceforge.net /project/shownotes.php?release_id=277371
Sources
- CVE List CVE-2004-2640
- NVD CVE-2004-2640
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.