CVE-2018-7490: uWSGI --php-docroot check bypass allows directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityHigh CVSS (7.5) with no authentication required, public exploit code, and very high EPSS, though not listed in KEV.

What it is

uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check when the --php-docroot option is used, permitting directory traversal. The flaw is a path traversal (CWE-22) that exposes files outside the intended PHP document root. It matters because the affected option is used to serve PHP content, and the record gives no indication that exploitation requires credentials.

Impact

An attacker can read files outside the configured PHP document root, gaining access to data the server intended to keep out of reach. The CVSS vector rates confidentiality impact as high with no integrity or availability impact.

Attack surface

Reachable over the network via HTTP requests to a uWSGI instance running with the --php-docroot option; the CVSS vector shows no privileges required and no user interaction. The description does not state whether the affected option is enabled by default, so exposure depends on that configuration.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.69 (99th percentile), and a public Exploit-DB entry (44223) exists, indicating exploit code is available. The record does not confirm observed in-the-wild exploitation.

What to do

• Upgrade uWSGI to 2.0.17 or later, which the vendor changelog identifies as the fix.
• Apply the Debian security update DSA-4142 if running the distribution package.
• If upgrading is not immediately possible, disable or avoid the --php-docroot option and restrict filesystem permissions for the uWSGI process.
• Limit network access to uWSGI/PHP endpoints to trusted clients until patched.

Detection

• Inspect HTTP request logs for traversal sequences such as ../ or encoded variants targeting PHP-handled paths.
• Monitor for requests returning files outside the configured document root, especially configuration or credential files.
• Alert on uWSGI processes running with --php-docroot and correlate with unusual file-read patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.