id: GO-2023-1737
modules:
    - module: github.com/gin-gonic/gin
      versions:
        - introduced: 1.3.1-0.20190301021747-ccb9e902956d
          fixed: 1.9.1
      vulnerable_at: 1.9.0
      packages:
        - package: github.com/gin-gonic/gin
          symbols:
            - Context.FileAttachment
summary: |-
    Improper handling of filenames in Content-Disposition HTTP header in
    github.com/gin-gonic/gin
description: |-
    The filename parameter of the Context.FileAttachment function is not properly
    sanitized. A maliciously crafted filename can cause the Content-Disposition
    header to be sent with an unexpected filename value or otherwise modify the
    Content-Disposition header. For example, a filename of "setup.bat&quot;;x=.txt"
    will be sent as a file named "setup.bat".

    If the FileAttachment function is called with names provided by an untrusted
    source, this may permit an attacker to cause a file to be served with a name
    different than provided. Maliciously crafted attachment file name can modify the
    Content-Disposition header.
ghsas:
    - GHSA-2c4m-59x9-fr2g
credits:
    - motoyasu-saburi
references:
    - report: https://github.com/gin-gonic/gin/issues/3555
    - fix: https://github.com/gin-gonic/gin/pull/3556
    - web: https://github.com/gin-gonic/gin/releases/tag/v1.9.1
cve_metadata:
    id: CVE-2023-29401
    cwe: 'CWE 20: Improper Input Validation'