GitHub Advisoryadvisory · Go

GHSA-j453-hm5x-c46w Echo vulnerable to directory traversal

MEDIUM Published 2022-12-07 Modified 2022-12-12 Official page ↗
Aliases
CVE-2020-36565
Ecosystem
Go
Packages
github.com/labstack/echo/v4
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-12-07

Affected packages

• Go github.com/labstack/echo/v4: < 4.2.0 → fixed in 4.2.0

Description

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

Related

Alias · CVE (1)

  • CVE-2020-36565 Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References