modules:
  - module: github.com/gin-gonic/gin
    versions:
      - introduced: 1.3.1-0.20190301021747-ccb9e902956d
    vulnerable_at: 1.9.0
    packages:
      - package: github.com/gin-gonic/gin
        symbols:
          - Context.FileAttachment
summary: Improper handling of file names in Content-Disposition HTTP header
description: |
    The filename parameter of the Context.FileAttachment function is
    not properly sanitized. A maliciously crafted filename can cause
    the Content-Disposition header to be sent with an unexpected
    filename value or otherwise modify the Content-Disposition header.
    For example, a filename of "setup.bat&quot;;x=.txt" will be sent
    as a file named "setup.bat".

    If the FileAttachment function is called with names provided by an
    untrusted source, this may permit an attacker to cause a file to
    be served with a name different than provided. Maliciously crafted
    attachment file name can modify the Content-Disposition header.
credits:
  - motoyasu-saburi
references:
  - report: https://github.com/gin-gonic/gin/issues/3555
  - fix: https://github.com/gin-gonic/gin/pull/3556
cve_metadata:
    id: CVE-2023-29401
    cwe: 'CWE 20: Improper Input Validation'