VDB
Sign up
HIGH7.5

GHSA-vp56-r7qv-783v

ahh vulnerable to Path Traversal

Quick fix

GHSA-vp56-r7qv-783v — github.com/go-aah/aah: upgrade to the fixed version with the command below.

go get github.com/go-aah/aah@v0.12.4

Details

Due to improper santization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/go-aah/aah
Introduced in: 0Fixed in: 0.12.4
Fixgo get github.com/go-aah/aah@v0.12.4
Go/aahframe.work
Introduced in: 0Fixed in: 0.12.4
Fixgo get aahframe.work@v0.12.4

References