| packages: |
| - module: github.com/kataras/iris/v12 |
| package: github.com/kataras/iris/v12/context |
| symbols: |
| - Context.UploadFormFiles |
| versions: |
| - fixed: 12.2.0-alpha8 |
| vulnerable_at: 12.1.8 |
| - module: github.com/kataras/iris |
| package: github.com/kataras/iris/context |
| symbols: |
| - Context.UploadFormFiles |
| vulnerable_at: 0.0.2 |
| description: | |
| The Context.UploadFormFiles function is vulnerable to directory |
| traversal attacks, and can be made to write to arbitrary locations |
| outside the destination directory. |
| |
| This vulnerability only occurs when built with Go versions prior to 1.17. |
| Go 1.17 and later strip directory paths from filenames returned by |
| "mime/multipart".Part.FileName, which avoids this issue. |
| cves: |
| - CVE-2021-23772 |
| ghsas: |
| - GHSA-jcxc-rh6w-wf49 |
| credit: Snyk Security Team |
| links: |
| commit: https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08 |
| context: |
| - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169 |
| - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170 |
