# Path traversal attack **URL:** \ **Category:** SCM-Manager Bug Reports\ **Created:** [January 17, 2022, 12:26pm UTC](https://community.cloudogu.com/t/path-traversal-attack/463 "2022-01-17T12:26:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![rjsalmeida](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/rjsalmeida/32/330_2.png) [@rjsalmeida](https://community.cloudogu.com/u/rjsalmeida)\ **Post date:** [January 17, 2022, 12:26pm UTC](https://community.cloudogu.com/t/path-traversal-attack/463/1 "2022-01-17T12:26:38Z")
Hello, I’m using SCM-Manager 2.27.2 and our security team found a path traversal attach. Example: wget --no-check-certificate [https://xxx:14151/scm//etc/passwd](https://xxx:14151/scm//etc/passwd) Its unclear if this issue is due to a misconfiguration of SCM-Manager or a vulnerability in the application itself. SCM-Manager release notes and security advisories do not state that the current version is affected by a known pathtraversal vulnerability Can you help? Thanks ---
**Author:** ![pfeuffer](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/pfeuffer/32/72_2.png) [@pfeuffer](https://community.cloudogu.com/u/pfeuffer)\ **Post date:** [January 17, 2022, 3:09pm UTC](https://community.cloudogu.com/t/path-traversal-attack/463/2 "2022-01-17T15:09:13Z")
Hi, thanks for this report. We can reproduce this and have found the error. Right now the release build of 2.29.1 is running and the fixed version should be available within the next hour. René ---
**Author:** ![pfeuffer](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/pfeuffer/32/72_2.png) [@pfeuffer](https://community.cloudogu.com/u/pfeuffer)\ **Post date:** [January 17, 2022, 4:01pm UTC](https://community.cloudogu.com/t/path-traversal-attack/463/3 "2022-01-17T16:01:52Z")
The fixed version is released. The related blog post can be found [here](https://scm-manager.org/blog/posts/2022-01-17-scm-manager-2-29-1/). ---
**Author:** ![sebastian.sdorra](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/sebastian.sdorra/32/7_2.png) [@sebastian.sdorra](https://community.cloudogu.com/u/sebastian.sdorra)\ **Post date:** [January 18, 2022, 7:13am UTC](https://community.cloudogu.com/t/path-traversal-attack/463/4 "2022-01-18T07:13:26Z")
Unlisted on January 18, 2022, 7:13am UTC ---
**Author:** ![pfeuffer](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/pfeuffer/32/72_2.png) [@pfeuffer](https://community.cloudogu.com/u/pfeuffer)\ **Post date:** [January 18, 2022, 7:39am UTC](https://community.cloudogu.com/t/path-traversal-attack/463/5 "2022-01-18T07:39:25Z")
We decided to “unlist” this post for the next days, so users have the chance to patch their installations. We will make this public again after some time (probably following [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure) standards). We hope you approve this approach, @rjsalmeida . And thanks again for this important information. ---
**Author:** ![pfeuffer](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/pfeuffer/32/72_2.png) [@pfeuffer](https://community.cloudogu.com/u/pfeuffer)\ **Post date:** [April 21, 2022, 12:02pm UTC](https://community.cloudogu.com/t/path-traversal-attack/463/6 "2022-04-21T12:02:52Z")
Listed on April 21, 2022, 12:02pm UTC ---
**Author:** ![felix.ebert](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/felix.ebert/32/1554_2.png) [@felix.ebert](https://community.cloudogu.com/u/felix.ebert)\ **Post date:** [July 22, 2022, 11:16am UTC](https://community.cloudogu.com/t/path-traversal-attack/463/7 "2022-07-22T11:16:29Z")
Closed on July 22, 2022, 11:16am UTC I have closed this thread since there was no activity in the last 30 days.