Skip to content
Fencer Intel
high 7.5

CVE-2017-10974 in the critical feed json

Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080.

published 2017-07-07 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-2612

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
81.0%
EPSS 81.0% chance of exploitation in 30 days, percentile 99.6%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial /%5C sequence to defeat traversal protection mechanisms; the initial /%5C sequence was apparently not discussed in earlier research on this product.

Patch / fix

  • yaws Debian 14, Debian 13, Debian 12 1.91-2

debian advisories DEBIAN-CVE-2017-10974

Timeline

  1. First public exploit (EDB-42303)
  2. Published

Exploit prediction

81.03% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-42303 Yaws 1.91 - Remote File Disclosure remote, 2017-07-07
  • Nuclei template Yaws 1.91 - Local File Inclusion nuclei detection template
  • hyp3rlinx.altervista.org http://hyp3rlinx.altervista.org/advisories/YAWS-WEB-SERVER-v1.91-UNAUTHENTICATED-REMOTE-FILE-DISCLOSURE.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.