CVE-2012-5641: Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as

Q: How do I fix CVE-2012-5641?

couchdb: upgrade to newer than 1.0.3; mochiweb: upgrade to newer than 2.3.2. Exact commands for each OS are on this page.

Q: Is CVE-2012-5641 being exploited?

CVE-2012-5641 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2012-5641 affect?

CVE-2012-5641 affects couchdb, mochiweb. Severity is medium (CVSS 5.0). Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files

Q: How urgent is CVE-2012-5641?

Priority 51/100. EPSS top 5%: very likely to be exploited; Public exploit reference; On your watchlist

This week

MEDIUM 5.0WATCHLISTUPGRADEUPGRADE

CVE-2012-5641 is a medium-severity flaw (CVSS 5.0) affecting couchdb, mochiweb. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the default URI.

Why this priority

EPSS top 5%: very likely to be exploited
Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	5.0 (Medium)
EPSS exploit chance	8.9% (top 5%)
CISA exploited list	No
Weakness	CWE-22
Published	2014-03-18
Last modified	2026-06-16

Publisher (CNA): Red Hat, Inc. · Vendor: apache · mochiweb project

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2014-03-18 17:02 UTCPublished CVE record published
2026-06-16 23:47 UTCUpdated Record last modified

apache couchdb UPGRADE

Affected: <= 1.0.3 · 1.0.0 · 1.0.1 · 1.0.2 · 1.1.0 · 1.1.1 · 1.2.0

Fixed in: newer than 1.0.3

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy couchdb || rpm -q couchdb || couchdb --version

2. UPGRADE to newer than 1.0.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade couchdb

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade couchdb

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

mochiweb project mochiweb UPGRADE

Affected: <= 2.3.2 · 2.1.0 · 2.2.0 · 2.2.1 · 2.3.0 · 2.3.1

Fixed in: newer than 2.3.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy mochiweb || rpm -q mochiweb || mochiweb --version

2. UPGRADE to newer than 2.3.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade mochiweb

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade mochiweb

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2012-5641?

couchdb: upgrade to newer than 1.0.3; mochiweb: upgrade to newer than 2.3.2. Exact commands for each OS are on this page.

Is CVE-2012-5641 being exploited?

CVE-2012-5641 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2012-5641 affect?

CVE-2012-5641 affects couchdb, mochiweb. Severity is medium (CVSS 5.0). Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files

How urgent is CVE-2012-5641?

Priority 51/100. EPSS top 5%: very likely to be exploited; Public exploit reference; On your watchlist

Related CVEs

CVE-2023-45725 MEDIUM 5.7 UPGRADE Design document functions which receive a user http request object may expose authorization or session cookie
CVE-2023-26268 MEDIUM 4.4 UPGRADE UPGRADE Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascrip
CVE-2022-24706 CRITICAL 9.8 EXPLOITED UPGRADE Apache CouchDB Insecure Default Initialization of Resource Vulnerability
CVE-2021-38295 HIGH 7.3 UPGRADE In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML
CVE-2020-1955 CRITICAL 9.8 DOWNGRADE CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire datab

References

← Back to latest CVEs