GO-2021-0051
Directory traversal on Windows in github.com/labstack/echo/v4
At a glance
- Published
- Updated
- CVE
- CVE-2020-36565
- Aliases
- GHSA-j453-hm5x-c46w
Description
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/labstack/echo/v4 | introduced 0, fixed 4.1.18-0.20201215153152-4422e3b66b9f |
References
- https://github.com/labstack/echo/pull/1718 FIX
- https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |