CVE

CVE-2018-10245

5.3

CVSS

Description

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters.

Attack Vector

Privileges Req.

User Interaction

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumMisconfiguration~10 seconds

AWStats <= 7.5 - Full Path Disclosure

AWStats 7.6 contains a full path disclosure caused by improper handling of framename and update parameters in awstats.pl, letting remote attackers determine server file paths, exploit requires sending crafted parameters. References: https://github.com/eldy/awstats https://awstats.sourceforge.io/ Remediation: Update to the latest version of AWStats or apply security patches addressing this issue.

url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →