GO-2026-5777 Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi...

GO-2026-5775 Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi...

Duplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mqqf-5wvp-8fh8. This link is maintained to preserve external references. Original Description An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect...

DEBIAN-CVE-2025-69725

An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain...

CVE-2025-69725

An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain...

CVE-2025-69725

An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain...

CVE-2025-69725

An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain...

GO-2026-4316 Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi

Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the RedirectSlashes function. An attacker can redirect users to an external, attacker-controlled website by crafting a specially formatted URL containing backslashes, which browsers interpret as a protocol-relative...

Remote Code Execution (RCE)

github.com/tnborg/panel is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper path handling in the CleanPath middleware from the go-chi/chi package, which fails to process r.URL.Path, followed by flaws in backend login path exposure, which allows an attacker to bypass...