Sanic arbitrary file read and directory traversal

2022-05-1700:19:52

Google

osv.dev

0.004 Low

EPSS

Percentile

72.5%

JSON

Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.

CPENameOperatorVersion
saniceq0.4.1
saniceq0.1.6
saniceq0.1.3
saniceq0.2.0
saniceq0.3.1
saniceq0.1.7
saniceq0.5.0
saniceq0.1.5
saniceq0.3.0
saniceq0.1.1

Name	Operator	Version
sanic	eq	0.4.1
sanic	eq	0.1.6
sanic	eq	0.1.3
sanic	eq	0.2.0
sanic	eq	0.3.1
sanic	eq	0.1.7
sanic	eq	0.5.0
sanic	eq	0.1.5
sanic	eq	0.3.0
sanic	eq	0.1.1

Rows per page:

1-10 of 151

References

github.com/channelcat/sanic/issues/633

github.com/channelcat/sanic/releases/tag/0.5.1

github.com/sanic-org/sanic

github.com/sanic-org/sanic/pull/635

nvd.nist.gov/vuln/detail/CVE-2017-16762

0.004 Low

EPSS

Percentile

72.5%

JSON

Related for OSV:GHSA-MPMF-HR8P-P49G