VDB
Sign up
HIGH7.5

GHSA-jcxc-rh6w-wf49

Link Following in Iris

Quick fix

GHSA-jcxc-rh6w-wf49 — github.com/kataras/iris/v12: upgrade to the fixed version with the command below.

go get github.com/kataras/iris/v12@v12.2.0-alpha8

Details

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/kataras/iris/v12
Introduced in: 0Fixed in: 12.2.0-alpha8
Fixgo get github.com/kataras/iris/v12@v12.2.0-alpha8
Go/github.com/kataras/iris
Introduced in: 0

No fixed version published yet for github.com/kataras/iris (go modules). Pin to a known-safe version or switch to an alternative.

References