CVE-2020-15111

In Fiber before version 1.12.6, the filename that is given in c.Attachment https://docs.gofiber.io/ctxattachment is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the...

CVE-2020-15111: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Fiber before version 1.12.6, the filename that is given in c.Attachment https://docs.gofiber.io/ctxattachment is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the...

PT-2020-14193

Name of the Vulnerable Software and Affected Versions Fiber versions prior to 1.12.6 Description The issue arises from improper input sanitization in the c.Attachment function, allowing a maliciously constructed filename to inject additional headers into an HTTP response. This can lead to a CRLF...