GitHub Advisoryadvisory · NuGet

GHSA-qcx4-gfh8-w5p5 Blogifier does not properly restrict APIs

CRITICAL Published 2022-05-24 Modified 2025-04-04 Official page ↗
Aliases
CVE-2019-12277
Ecosystem
NuGet
Packages
Blogifier.Core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2025-04-04

Affected packages

• NuGet Blogifier.Core: < 2.5.5 → fixed in 2.5.5

Description

Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for `..` in a pathname. The issue is patched in the `2.4` branch, but `2.5.5` is the lowest available patched version on https://www.nuget.org/packages/Blogifier.Core.

Related

Alias · CVE (1)

  • CVE-2019-12277 Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for .. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References