# CVE-1999-0270: SGI Performer API Search Tool directory traversal in pfdisplay.cgi

Source: https://junglewise.ai/threats/cve-1999-0270-sgi-performer-api-search-tool-directory-traversal-in-pfdisplay-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1998-04-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0270 · Severity: medium · CVSS 5 · Published 1998-04-03

A security vulnerability exists in the SGI Performer API Search Tool, a utility used for searching technical documentation. An attacker can exploit this flaw to remotely access and read sensitive files stored on the server that should not be publicly accessible. This could lead to the exposure of system configuration details or other private data, potentially aiding further attacks against the organization's infrastructure.

Vendors: [Sgi](https://junglewise.ai/threats/vendors/sgi).

## Quick answers

**Is CVE-1999-0270 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0270 being exploited in the wild.

**How severe is CVE-1999-0270?** Medium severity, with a CVSS score of 5, published 3 April 1998.

**Which products and versions are affected?** Sgi Performer API Search Tool All versions prior to April 1998.

**Is there a fix for CVE-1999-0270?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0270 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-1999-0270?** Check whether you run Sgi Performer API Search Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a classic directory traversal flaw located in the 'pfdisplay.cgi' (also known as 'pfdispaly.cgi') script, which is part of the SGI Performer API Search Tool (performer_tools). The CGI script fails to properly sanitize user-supplied input used in file path construction. A remote, unauthenticated attacker can use special characters (such as '../') in a URL request to bypass intended directory restrictions. This allows the attacker to read any file on the server that the web server process has permissions to access. SGI released a security advisory and patches in April 1998 to address this issue.

## Affected products

- SGI Performer API Search Tool (performer_tools) All versions prior to April 1998

## Timeline

- 1998-04-01: advisory: SGI released security advisory 19980401-01-P
- 1998-04-03: disclosed: Vulnerability published in NVD

## References

- [http://www.ciac.org/ciac/bulletins/i-041.shtml](http://www.ciac.org/ciac/bulletins/i-041.shtml)
- [http://www.osvdb.org/134](http://www.osvdb.org/134)
- [http://www.securityfocus.com/bid/64](http://www.securityfocus.com/bid/64)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/810](https://exchange.xforce.ibmcloud.com/vulnerabilities/810)