# CVE-2018-7490: uwsgi-plugin-python: uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory trave... CVE-2018-7490 is fixed in 44 products on 1 platform, first by libapache2-mod-proxy-uwsgi 2.0.15-10.2ubuntu2.1, released February 26, 2018. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2018-7490 - Priority: Routine - CVSS: n/a (Medium) - EPSS: 0.6942 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Feb 26, 2018 ## Description uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libapache2-mod-proxy-uwsgi Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [libapache2-mod-proxy-uwsgi 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libapache2-mod-proxy-uwsgi-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | libapache2-mod-ruwsgi Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [libapache2-mod-ruwsgi 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libapache2-mod-ruwsgi-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | libapache2-mod-uwsgi Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [libapache2-mod-uwsgi 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libapache2-mod-uwsgi-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | python-uwsgidecorators Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [python-uwsgidecorators 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-uwsgidecorators-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | python3-uwsgidecorators Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [python3-uwsgidecorators 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-uwsgidecorators-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-app-integration-plugins Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-app-integration-plugins 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-app-integration-plugins-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-core Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-core 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-core-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-emperor Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-emperor 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-emperor-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-extra Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-extra 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-extra-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-infrastructure-plugins Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-infrastructure-plugins 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-infrastructure-plugins-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-alarm-curl Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-alarm-curl 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-alarm-curl-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-alarm-xmpp Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-alarm-xmpp 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-alarm-xmpp-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-asyncio-python Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-asyncio-python 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-asyncio-python-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-asyncio-python3 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-asyncio-python3 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-asyncio-python3-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-curl-cron Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-curl-cron 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-curl-cron-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-emperor-pg Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-emperor-pg 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-emperor-pg-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-fiber Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-fiber 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-fiber-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-gccgo Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-gccgo 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-gccgo-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-geoip Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-geoip 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-geoip-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-gevent-python Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-gevent-python 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-gevent-python-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-glusterfs Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-glusterfs 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-glusterfs-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-graylog2 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-graylog2 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-graylog2-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-greenlet-python Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-greenlet-python 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-greenlet-python-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-jvm-openjdk-8 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-jvm-openjdk-8 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-jvm-openjdk-8-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-jwsgi-openjdk-8 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-jwsgi-openjdk-8 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-jwsgi-openjdk-8-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-ldap Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-ldap 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-ldap-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-lua5.1 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-lua5.1 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-lua5.1-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-lua5.2 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-lua5.2 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-lua5.2-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-mono Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-mono 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-mono-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-psgi Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-psgi 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-psgi-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-python Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-python 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-python-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-python3 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-python3 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-python3-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-rack-ruby2.5 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-rack-ruby2.5 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-rack-ruby2.5-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-rados Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-rados 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-rados-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-rbthreads Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-rbthreads 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-rbthreads-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-ring-openjdk-8 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-ring-openjdk-8 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-ring-openjdk-8-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-router-access Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-router-access 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-router-access-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-servlet-openjdk-8 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-servlet-openjdk-8 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-servlet-openjdk-8-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-sqlite3 Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-sqlite3 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-sqlite3-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-tornado-python Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-tornado-python 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-tornado-python-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugin-xslt Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugin-xslt 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugin-xslt-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-plugins-all Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-plugins-all 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-plugins-all-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | | Linux | uwsgi-src Ubuntu 18.04.6 LTS (bionic) | 2.0.15-10.2ubuntu2.1 | [uwsgi-src 2.0.15-10.2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-uwsgi-src-2.0.15-10.2ubuntu2.1.md) | Feb 26, 2018 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo