GO-2022-0272

    Dashboard / Vulnerabilities / GO-2022-0272

    GO-2022-0272

    Published: 15 Jul 2022Last Modified: 14 Jan 2025

    Summary: Directory traversal in github.com/kataras/iris and github.com/kataras/iris/v12

    Details: The Context.UploadFormFiles function is vulnerable to directory traversal attacks, and can be made to write to arbitrary locations outside the destination directory. This vulnerability only occurs when built with Go versions prior to 1.17. Go 1.17 and later strip directory paths from filenames returned by "mime/multipart".Part.FileName, which avoids this issue.

    References: https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08, https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169, https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170

    Affected packages

    Package

    Name: github.com/kataras/iris/v12

    Purl: pkg:golang/github.com/kataras/iris/v12

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -12.2.0-alpha8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2022-0272 | CVE-DB