{"schema_version":"1.3.1","id":"GO-2020-0033","modified":"2024-05-20T16:03:47Z","published":"2021-04-14T20:04:52Z","aliases":["CVE-2020-36559","GHSA-vp56-r7qv-783v"],"summary":"Path Traversal in aahframe.work","details":"Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.","affected":[{"package":{"name":"aahframe.work","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.4"}]}],"ecosystem_specific":{"imports":[{"path":"aahframe.work","symbols":["Application.Run","Application.ServeHTTP","Application.Start","HTTPEngine.Handle"]}]}}],"references":[{"type":"FIX","url":"https://github.com/go-aah/aah/pull/267"},{"type":"FIX","url":"https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec"},{"type":"REPORT","url":"https://github.com/go-aah/aah/issues/266"}],"credits":[{"name":"@snyff"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2020-0033","review_status":"REVIEWED"}}