CVE-2021-35397

    Dashboard / Vulnerabilities / CVE-2021-35397

    CVE-2021-35397

    Published: 4 Aug 2021Last Modified: 9 Jul 2026

    Summary:

    Details: A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticated, remote attacker to arbitrarily read files. The vulnerability is due to lack of proper input validation for requested path. An attacker could exploit this vulnerability by sending crafted HTTP request with specific path to read. Successful exploitation could allow the attacker to read files that should be restricted.

    References: https://github.com/an-tao/drogon, https://github.com/an-tao/drogon/wiki/ENG-02-Installation, https://github.com/an-tao/drogon/wiki/ENG-03-Quick-Start#Static-Site, https://github.com/an-tao/drogon/blob/834e3eabdd0441ad2bc80c02e8bbfc3b8312c213/lib/src/StaticFileRouter.cc#L62-L67

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fb17efe765d162be01680b05a3a387c7a182a4c5
    Fixed -None

    Affected versions

    1.0.0-NA
    1.0.0-beta14
    1.0.0-beta15
    1.0.0-beta16
    1.0.0-beta17
    1.0.0-beta18
    1.0.0-beta19
    1.0.0-beta20
    1.0.0-beta21

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-35397 | CVE-DB