Arbitrary File Delete

github.com/tyktechnologies/tyk is vulnerable to arbitrary file delete. The vulnerability exists through the handleAddOrUpdateApi function in api.go where json files outside of the application can be deleted if the file path is specified in the request...

CVE-2021-23357: Improper Limitation of a Pathname to a Restricted Directory

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this valu...

PT-2021-15459

Name of the Vulnerable Software and Affected Versions Tyk Gateway versions affected versions not specified Description The issue allows for Directory Traversal, enabling the deletion of arbitrary JSON files on the disk where Tyk is running. This is achieved through the handleAddOrUpdateApi...