| Package | Affected versions | Patched versions |
|---|---|---|
| flask-cors | < 3.0.9 | 3.0.9 |
| flask-cors | < 3.0.9 | 3.0.9 |
| backports sle | = 15.0 |
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free