CVE-2011-2524 Path traversal in n/a
Remote attackers can read arbitrary files via encoded dot-dot sequences in URIs due to a directory traversal flaw in the libsoup library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-2524?
CVE-2011-2524 is a medium-severity path traversal vulnerability in n/a, published on 31 Aug 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.
Weakness: CWE-22
Which versions are affected by CVE-2011-2524?
It affects 1 product.
Linux distribution packages (3)
libsoup Red Hat:enterprise_linux:6::server | All versions | 0:2.28.2-1.el6_1.1 |
libsoup-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:2.28.2-1.el6_1.1 |
libsoup-devel Red Hat:enterprise_linux:6::server | All versions | 0:2.28.2-1.el6_1.1 |
Products include Gnome Libsoup.
How do I fix CVE-2011-2524?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2011-2524 being exploited?
There is no known exploitation of CVE-2011-2524 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
- CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly
- CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
- CVE-2026-102559 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
- CVE-2026-102560 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
Sources
Also known as DEBIAN-CVE-2011-2524, DSA-2369-1, GHSA-xm6g-x36q-hxpx, RHSA-2011:1102.