GitHub Advisoryadvisory · Go

GHSA-f7ff-xf87-f22q Arbitrary command execution in Minidoc

HIGH Published 2022-05-27 Modified 2022-06-09 Official page ↗
Aliases
CVE-2022-29637
Ecosystem
Go
Packages
github.com/mindoc-org/mindoc
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2022-06-03

Affected packages

• Go github.com/mindoc-org/mindoc: <= 2.1-beta.5 (no fix yet)

Description

An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.

Related

Alias · CVE (1)

  • CVE-2022-29637 An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References