Description
uWSGI is a software application that "aims at developing a full stack for building hosting services".
The uWSGI PHP plugin before 2.0.17 is vulnerable to Path Traversal Vulnerability when used without specifying the php-allowed-docroot option.
The vulnerability exists due to improper validation of the file path when requesting a resource under the DOCUMENT_ROOT directory which is specified via php-docroot.
A remote attacker could exploit this weakness to read arbitrary files from the vulnerable system using path traversal sequences (..%2f).
Remediation
Upgrade to the latest version uWSGI. This vulnerability was fixed in uWSGI version 2.0.17.
References
Related Vulnerabilities
WordPress Plugin Revamp CRM for WooCommerce Local File Inclusion (1.0.3)
WordPress Plugin myEASYbackup 'dwn_file' Parameter Directory Traversal (1.0.8.1)
WordPress Plugin Vitamin Multiple Arbitrary File Disclosure Vulnerabilities (1.0.0)
WordPress Plugin Insert Pages Directory Traversal (3.2.3)
WordPress Plugin WP e-Commerce Shop Styling Arbitrary File Download (2.5)