modules:
  - module: github.com/gofiber/fiber
    versions:
      - fixed: 1.12.6
    packages:
      - package: github.com/gofiber/fiber
        symbols:
          - Ctx.Attachment
description: |
    Due to improper input sanitization, a maliciously constructed filename
    could cause a file download to use an attacker controlled filename, as well
    as injecting additional headers into an HTTP response.
published: 2021-07-28T18:08:05Z
cves:
  - CVE-2020-15111
ghsas:
  - GHSA-9cx9-x2gp-9qvh
credit: Hasibul Hasan and Abdullah Shaleh
references:
  - fix: https://github.com/gofiber/fiber/pull/579
  - fix: https://github.com/gofiber/fiber/commit/f698b5d5066cfe594102ae252cd58a1fe57cf56f