You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@tomcat.apache.org by bu...@apache.org on 2026/07/09 13:29:15 UTC

[Bug 70141] Shell Command Injection via CGIServlet Argument Injection on Linux

https://bz.apache.org/bugzilla/show_bug.cgi?id=70141

Christopher Schultz <ch...@christopherschultz.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 OS|                            |All
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #1 from Christopher Schultz <ch...@christopherschultz.net> ---
This is security vulnerability in the script and not in the CGIServlet itself.

The only reason there is some protection on Windows is due to the fact that
that there are multiple incompatible parsing regimes in Windows environments
which makes protection difficult, while no such difficulties exist on UNIX-like
environments.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org