CVE-2017-1000501

Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.

• CWE-22

• http://www.awstats.org/Vendor Advisory
• https://github.com/eldy/awstats/commit/06c0ab29c1e5059d9e0279c6b64d573d619e1651Patch, Third Party Advisory
• https://github.com/eldy/awstats/commit/cf219843a74c951bf5986f3a7fffa3dcf99c3899Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/01/msg00012.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202007-37
• https://www.debian.org/security/2018/dsa-4092Third Party Advisory
• http://www.awstats.org/Vendor Advisory
• https://github.com/eldy/awstats/commit/06c0ab29c1e5059d9e0279c6b64d573d619e1651Patch, Third Party Advisory
• https://github.com/eldy/awstats/commit/cf219843a74c951bf5986f3a7fffa3dcf99c3899Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/01/msg00012.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202007-37
• https://www.debian.org/security/2018/dsa-4092Third Party Advisory

Published

Jan 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000496Commsy version 9.0.0 is vulnerable to XXE attacks in the con…
• CVE-2017-1000497Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks i…9.8
• CVE-2017-1000498AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the…7.8
• CVE-2017-1000499phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulne…
• CVE-2017-10005Vulnerability in the Oracle FLEXCUBE Private Banking compone…
• CVE-2017-1000500Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-1000502Users with permission to create or configure agents in Jenki…
• CVE-2017-1000503A race condition during Jenkins 2.81 through 2.94 (inclusive…
• CVE-2017-1000504A race condition during Jenkins 2.94 and earlier; 2.89.1 and…
• CVE-2017-1000505In Jenkins Script Security Plugin version 1.36 and earlier, …
• CVE-2017-1000506Mautic version 2.11.0 and earlier contains a Cross Site Scri…
• CVE-2017-1000507Canvs Canvas version 3.4.2 contains a Cross Site Scripting (…