CVE-2016-1231

Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) in an unspecified path.

• CWE-22

• http://blog.prosody.im/prosody-0-9-9-security-release/Patch, Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175868.html
• http://www.debian.org/security/2016/dsa-3439
• http://www.openwall.com/lists/oss-security/2016/01/08/5
• https://prosody.im/issues/issue/520
• https://prosody.im/security/advisory_20160108-1/Vendor Advisory
• http://blog.prosody.im/prosody-0-9-9-security-release/Patch, Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175868.html
• http://www.debian.org/security/2016/dsa-3439
• http://www.openwall.com/lists/oss-security/2016/01/08/5
• https://prosody.im/issues/issue/520
• https://prosody.im/security/advisory_20160108-1/Vendor Advisory

Published

Jan 12, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1225Trend Micro Internet Security 8 and 10 allows remote attacke…
• CVE-2016-1226Cross-site scripting (XSS) vulnerability in Trend Micro Inte…
• CVE-2016-1227NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400…7.2
• CVE-2016-1228Cross-site request forgery (CSRF) vulnerability on NTT EAST …8.8
• CVE-2016-1229Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-be…
• CVE-2016-1230Cross-site scripting (XSS) vulnerability in NTT PC Communica…
• CVE-2016-1232The mod_dialback module in Prosody before 0.9.9 does not pro…
• CVE-2016-1233An unspecified udev rule in the Debian fuse package in jessi…
• CVE-2016-1234Stack-based buffer overflow in the glob implementation in GN…
• CVE-2016-1235The oarsh script in OAR before 2.5.7 allows remote authentic…
• CVE-2016-1236Multiple cross-site scripting (XSS) vulnerabilities in (1) r…
• CVE-2016-1237nfsd in the Linux kernel through 4.6.3 allows local users to…