CVE-2019-25073: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

December 28, 2022 (updated January 7, 2023)

Improper path santiziation in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.

References

github.com/advisories/GHSA-fjgq-224f-fq37
github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39
github.com/goadesign/goa/pull/2388
nvd.nist.gov/vuln/detail/CVE-2019-25073
pkg.go.dev/vuln/GO-2020-0032

Code Behaviors & Features

Detect and mitigate CVE-2019-25073 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →