CVE-2022-31515

The Delor4/CarceresBE repository through 1.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31515

The CVE describes a path traversal vulnerability in the Delor4/CarceresBE repository (through version 1.0) where Flask’s send_file is used unsafely, allowing an attacker to access arbitrary files on the filesystem. Affected component: CarceresBE (backend) built with Flask; root cause is improper ...