GHSA-3227-r97m-8j95: Relative Path Traversal in afire serve_static

April 22, 2022

This vulnerability effects the built-in afire serve_static extension allowing paths containing //.... to bypass the previous path sanitation and request files in higher directories that should not be accessible.

References

github.com/Basicprogrammer10/afire
github.com/Basicprogrammer10/afire/commit/da7904c04f82e1cb43cc42eaf6a1dba072b5c921
github.com/Basicprogrammer10/afire/releases/tag/v1.1.0
github.com/Basicprogrammer10/afire/security/advisories/GHSA-3227-r97m-8j95
github.com/advisories/GHSA-3227-r97m-8j95

Code Behaviors & Features

Detect and mitigate GHSA-3227-r97m-8j95 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →