Vulnerability GHSA-8cw9-5hmv-77w6

High Risk

4 years ago

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

0.1.0 - 20.12.6 and 21.3.0 - 21.12.1 and 22.3.0 - 22.6.0

Summary

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

Details

Impact

Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted.

Patches

v20.12.7 (LTS)
v21.12.2 (LTS)
v22.6.1

References

https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495

For more information

If you have any questions or comments about this advisory:

Open an issue in the community forums
Ping us on the Discord server

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

14 days ago

sanic chunked trailer request smuggling allows hidden second request execution

0.1.0 - 24.12.0 and 25.12.0 GHSA-wmj6-g64g-j7q5

High Risk

2 months ago

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

0.1.0 - 20.12.6 and 21.3.0 - 21.12.1 and 22.3.0 - 22.6.0 PYSEC-2026-918

High Risk

4 years ago

Sanic arbitrary file read and directory traversal

0.1.0 - 0.5.0 GHSA-mpmf-hr8p-p49g

High Risk

4 years ago

Server crash if running Python 3.10 w/ Sanic 20.12

0.1.7 - 20.12.5 GHSA-7p79-6x2v-5h88

Unknown

8 years ago

No summary available

0.1.0 - 0.5.0 PYSEC-2017-40

View all vulnerabilities for these packages

Impacted packages

sanic

Timeline

Published

4 years ago

Fixed (20.12.7)

4 years ago

Fixed (21.12.2)

4 years ago

Fixed (22.6.1)

4 years ago

Last Modified

2 months ago