Directory traversal

2022-08-0122:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

45.5%

JSON

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.

CPENameOperatorVersion
sanicge22.0.0
saniclt22.6.1
sanicge21.0.0
saniclt21.12.2
saniclt20.12.7

Name	Operator	Version
sanic	ge	22.0.0
sanic	lt	22.6.1
sanic	ge	21.0.0
sanic	lt	21.12.2
sanic	lt	20.12.7

References

github.com/sanic-org/sanic/issues/2478

github.com/sanic-org/sanic/pull/2495

github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6

0.001 Low

EPSS

Percentile

45.5%

JSON

Related for PRION:CVE-2022-35920