Summary
generated automatically from NVD dataCVE-2009-3898 is a directory traversal flaw (CWE-22) in nginx's src/http/modules/ngx_http_dav_module.c, affecting versions before 0.7.63 and 0.8.x before 0.8.17. An authenticated remote user can include ".." in the Destination HTTP header of a WebDAV COPY or MOVE request. This lets them create or overwrite arbitrary files. NVD rates it 4.9 (MEDIUM) under CVSS v2.0.
NVD description
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.
EPSS · FIRST.org
15.9%probability of exploitation in the next 30 days
Higher than 96% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-02, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 24 nov. 2009
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- secalert@redhat.com
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (18)
- http://secunia.com/advisories/36818Vendor Advisory
- http://secunia.com/advisories/36818Vendor Advisory
- + 3 more references on NVD
Similar CVEs
Other vulnerabilities of type CWE-22
Running nginx? Know which CVEs hit your version.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.