GitHub Advisoryadvisory · PyPI

GHSA-q7mf-hp9m-cx6f Roundup Directory traversal vulnerability

MEDIUM Published 2022-04-29 Modified 2024-05-09 Official page ↗
Aliases
CVE-2004-1444
Ecosystem
PyPI
Packages
Roundup
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2024-05-09

Affected packages

• PyPI Roundup: < 0.7.3 → fixed in 0.7.3

Description

Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via `..` (dot dot) sequences in an `@@` command in an HTTP GET request.

Related

Alias · CVE (1)

  • CVE-2004-1444 Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via .. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References