—
PYSEC-2022-225
Quick fix
PYSEC-2022-225 — ganga: upgrade to the fixed version with the command below.
pip install --upgrade 'ganga>=730e7aba192407d35eb37dd7938d49071124be8c'Details
The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/ganga
Introduced in:
0Fixed in: 730e7aba192407d35eb37dd7938d49071124be8cFix
pip install --upgrade 'ganga>=730e7aba192407d35eb37dd7938d49071124be8c'