CVE-2016-6255

Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.

• CWE-284

• http://www.debian.org/security/2016/dsa-3736Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/07/18/13Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/07/20/5Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/92050Third Party Advisory, VDB Entry
• https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbdIssue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201701-52
• https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLogRelease Notes, Third Party Advisory
• https://twitter.com/mjg59/status/755062278513319936Third Party Advisory
• https://www.exploit-db.com/exploits/40589/
• https://www.tenable.com/security/research/tra-2017-10
• http://www.debian.org/security/2016/dsa-3736Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/07/18/13Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/07/20/5Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/92050Third Party Advisory, VDB Entry
• https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbdIssue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201701-52
• https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLogRelease Notes, Third Party Advisory
• https://twitter.com/mjg59/status/755062278513319936Third Party Advisory
• https://www.exploit-db.com/exploits/40589/
• https://www.tenable.com/security/research/tra-2017-10

Published

Mar 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6249F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which tim…
• CVE-2016-6250Integer overflow in the ISO9660 writer in libarchive before …
• CVE-2016-6251Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-6252Integer overflow in shadow 4.2.1 allows local users to gain …
• CVE-2016-6253mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through…
• CVE-2016-6254Heap-based buffer overflow in the parse_packet function in n…
• CVE-2016-6256SAP Business One for Android 1.2.3 allows remote attackers t…
• CVE-2016-6257The firmware in Lenovo Ultraslim dongles, as used with Lenov…6.5
• CVE-2016-6258The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earl…
• CVE-2016-6259Xen 4.5.x through 4.7.x do not implement Supervisor Mode Acc…
• CVE-2016-6261The idna_to_ascii_4i function in lib/idna.c in libidn before…
• CVE-2016-6262idn in libidn before 1.33 might allow remote attackers to ob…