CVE-2018-18837

An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.

• CWE-113

• https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L367-L370Third Party Advisory
• https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97caPatch, Third Party Advisory
• https://github.com/netdata/netdata/pull/4521Third Party Advisory
• https://www.red4sec.com/cve/netdata_header_injection.txtExploit, Third Party Advisory
• https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L367-L370Third Party Advisory
• https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97caPatch, Third Party Advisory
• https://github.com/netdata/netdata/pull/4521Third Party Advisory
• https://www.red4sec.com/cve/netdata_header_injection.txtExploit, Third Party Advisory

Published

Jun 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18830An issue was discovered in com\mingsoft\basic\action\web\Fil…
• CVE-2018-18831An issue was discovered in com\mingsoft\cms\action\Generater…
• CVE-2018-18832admin/check.asp in DKCMS 9.4 allows SQL Injection via an ASP…
• CVE-2018-18834An issue has been found in libIEC61850 v1.3. It is a heap-ba…
• CVE-2018-18835upload_template() in system/changeskin.php in DocCms 2016.5.…
• CVE-2018-18836An issue was discovered in Netdata 1.10.0. JSON injection ex…
• CVE-2018-18838An issue was discovered in Netdata 1.10.0. Log Injection (or…
• CVE-2018-18839An issue was discovered in Netdata 1.10.0. Full Path Disclos…
• CVE-2018-1884IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0…4.8
• CVE-2018-18840XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndT…
• CVE-2018-18841XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndT…
• CVE-2018-18842CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-B…