Directory Traversal

2022-08-0209:27:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

45.5%

JSON

sanic is vulnerable to directory traversal. The vulnerability exists due to a lack of sanitization of URL paths in the _handler function allowing an attacker to access lateral directories when using app.static if using encoded %2F URLs.

CPENameOperatorVersion
sanicle20.3.0
sanicle20.12.6
sanicle22.6.0
sanicle21.12.1
sanicle20.3.0
sanicle20.12.6
sanicle22.6.0
sanicle21.12.1

Name	Operator	Version
sanic	le	20.3.0
sanic	le	20.12.6
sanic	le	22.6.0
sanic	le	21.12.1
sanic	le	20.3.0
sanic	le	20.12.6
sanic	le	22.6.0
sanic	le	21.12.1

References

github.com/sanic-org/sanic/issues/2477

github.com/sanic-org/sanic/issues/2478

github.com/sanic-org/sanic/pull/2495

github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6

0.001 Low

EPSS

Percentile

45.5%

JSON

Related for VERACODE:36564