CVE-2021-23772: Improper Link Resolution Before File Access ('Link Following')

January 6, 2022 (updated February 9, 2023)

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

References

github.com/advisories/GHSA-jcxc-rh6w-wf49
github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08
nvd.nist.gov/vuln/detail/CVE-2021-23772
pkg.go.dev/vuln/GO-2022-0272
snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169
snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170

Code Behaviors & Features

Detect and mitigate CVE-2021-23772 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →