Vulnerable Systems:
* Apache CouchDB 1.0.3 and prior
Apache CouchDB contains a flaw that allows an attacker to traverse outside of a restricted path. The issue is due to the program not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../). This directory traversal attack would allow a remote attacker to gain access to arbitrary files.
Work-Around:
Users may simply exclude any file-based web serving components directly within their configuration file, typically in `local.ini`. On a default CouchDB installation, this requires amending the `favicon.ico` and `_utils` lines within `[httpd_global_handlers]`:
