Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. Details SWS validates the provided username before performing any password verification. - Invalid Username: The server returns a 401 Unauthorized response immediately. - Valid Username: The server proceeds to verify the password (e.g., using bcrypt), which introduces a different execution path and measurable timing discrepancy. This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoC The following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user…
Recommended action: Upgrade to 2.41.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Symbolic links (symlinks) could be used to access files or directories outside the intended web root folder. Details SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC - Serve a directory (web root) with SWS. - Create a symlink inside the web root that points to a file outside the web root. e.g. ln -s escape.txt $HOME/.bashrc - Open http://localhost/escape.txt in your browser. - The file content will be served. Impact Any web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted.
Recommended action: Upgrade to 2.40.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like <img src=x onerror=alert(1).txt will allow JavaScript code execution in the context of the web server’s domain. Details SWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least filename and currentpath could contain malicious data however. fileuri could also be malicious but the relevant scenarios seem to be all caught by hyper. Impact For any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability.
Recommended action: Upgrade to 2.30.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.