GitHub Advisoryadvisory · Packagist

GHSA-8c5p-4362-9333 Path traversal in grav

HIGH Published 2021-11-10 Modified 2021-11-08 Official page ↗

Aliases: CVE-2021-3924
Ecosystem: Packagist
Packages: getgrav/grav
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-22
Reviewed: 2021-11-08

Affected packages

• Packagist getgrav/grav: <= 1.7.24 (no fix yet)

Description

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Related

Alias · CVE (1)

CVE-2021-3924 grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References