—
GO-2022-0427
Unprotected file upload in github.com/swaggo/http-swagger
Quick fix
GO-2022-0427 — github.com/swaggo/http-swagger: upgrade to the fixed version with the command below.
go get github.com/swaggo/http-swagger@v1.2.6Details
The httpSwagger package's HTTP handler provides WebDAV read/write access to an in-memory filesystem. An attacker can exploit this to cause memory exhaustion by uploading many files, XSS attacks by uploading malicious files, or other unexpected behaviors.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/swaggo/http-swagger
Introduced in:
0Fixed in: 1.2.6Fix
go get github.com/swaggo/http-swagger@v1.2.6