← Vulnerability feed

Vulnerability record · CVE-2010-2263 · published 15 June 2010

CVE-2010-2263: nginx on Windows source code disclosure via ::$DATA URI suffix

F5 · Nginx

nginx versions 0.8 before 0.8.40 and 0.7 before 0.7.66 running on Windows allow remote attackers to read the source code or unparsed content of arbitrary files under the web document root. The flaw is triggered by appending ::$DATA to a URI, abusing Windows NTFS alternate data stream handling. This exposes server-side source and other files that should be interpreted or blocked rather than returned raw.

5.0 CVSS 2.0 Medium EPSS 72% · top 0.6% CWE-200 · Information exposure
5.0CVSS 2.0 base score
72%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 8 tagged exploit
16 Jun 2026Last modified by NVD

Description

nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote source code disclosure with public exploit code and very high EPSS, though limited to Windows-hosted nginx in older version ranges.

What it is

nginx versions 0.8 before 0.8.40 and 0.7 before 0.7.66 running on Windows allow remote attackers to read the source code or unparsed content of arbitrary files under the web document root. The flaw is triggered by appending ::$DATA to a URI, abusing Windows NTFS alternate data stream handling. This exposes server-side source and other files that should be interpreted or blocked rather than returned raw.

Impact

An unauthenticated attacker gains read access to source code and unparsed content of files within the web document root, which can reveal credentials, business logic and other sensitive data. There is no integrity or availability impact.

Attack surface

Reachable over the network via HTTP by sending a crafted URI with the ::$DATA suffix; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector. Only Windows-hosted nginx deployments in the affected version ranges are exposed.

Exploitation

Public exploit code exists, referenced by Exploit and ExploitDB tags in the references, and EPSS is high at 0.71926 (99.4th percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded.

What to do

  • Upgrade nginx to 0.8.40 or later, or 0.7.66 or later, on Windows hosts.
  • If upgrade is not immediately possible, restrict or block requests containing ::$DATA in the URI at the reverse proxy or WAF.
  • Move sensitive source and configuration files outside the web document root.
  • Verify that static file handling does not serve raw source for script extensions on Windows deployments.
  • Review Windows-hosted nginx instances for the affected version ranges and prioritize internet-facing ones.

Detection

  • Search web access logs for URIs containing ::$DATA, including URL-encoded variants such as %3A%3A%24DATA.
  • Alert on requests for script or configuration file extensions returning 200 with source-like content.
  • Monitor for repeated requests appending ::$DATA to known file paths from a single source.
  • Audit nginx version strings on Windows hosts against the affected ranges.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.html ExploitRelease NotesThird Party Advisory
http://www.exploit-db.com/exploits/13818 ExploitThird Party AdvisoryVDB Entry
http://www.exploit-db.com/exploits/13822 ExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/40760 ExploitThird Party AdvisoryVDB Entry
http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.html ExploitRelease NotesThird Party Advisory
http://www.exploit-db.com/exploits/13818 ExploitThird Party AdvisoryVDB Entry
http://www.exploit-db.com/exploits/13822 ExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/40760 ExploitThird Party AdvisoryVDB Entry

Track CVE-2010-2263 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.8CVE-2017-20005F5 nginx integer overflow vulnerabilityNGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes a…EPSS 3.3%9.8CVE-2016-0746F5 nginx use after free vulnerabilityUse-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of servi…EPSS 8.9%9.8CVE-2009-3555TLS/SSL renegotiation flaw allows plaintext injection into sessionsThe TLS protocol and SSL 3.0 do not properly bind renegotiation handshakes to the existing connection, so a man-in-the-middle can inject data that th…EPSS 87%analysed7.8CVE-2022-41741F5 nginx out-of-bounds write vulnerabilityNGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R…EPSS 0.79%7.8CVE-2016-1247F5 nginx link following vulnerabilityThe nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.0…EPSS 4.9%7.7CVE-2021-23017nginx resolver off-by-one allows 1-byte memory overwrite via forged DNS responseThe nginx resolver contains an off-by-one error (CWE-193) that lets an attacker who can forge UDP packets from the configured DNS server trigger a 1-…EPSS 53%analysed7.5CVE-2019-9511HTTP/2 window size and stream priority manipulation denial of serviceMultiple HTTP/2 implementations mishandle window size and stream prioritization, letting an attacker request a large resource across many streams and…EPSS 60%analysed

Source: NIST National Vulnerability Database (record CVE-2010-2263), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.