ahh vulnerable to Path Traversal

HIGH 7.5CVE-2020-36559 · GHSA-vp56-r7qv-783v · GO-2020-0033 · Published 27/12/2022 · updated 17/06/2026

In short

CVE-2020-36559 is a HIGH (CVSS 7.5) vulnerability affecting aahframe.work, github.com/go-aah/aah, aah (aahframework).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 69.3% of all vulnerabilities.
Fix: update to 0.12.4 or later.

Package	Affected versions	Patched versions
aahframe.work Go	`< 0.12.4`	`0.12.4`
github.com/go-aah/aah Go	`< 0.12.4`	`0.12.4`
aah aahframework	`< 0.12.4`	`0.12.4`

Description

Due to improper santization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

NVD description

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

References

nvd.nist.gov/vuln/detail/CVE-2020-36559 · ADVISORY
go-aah/aah · WEB
go-aah/aah#267 · WEB
go-aah/aah commit 881dc9f · WEB
go-aah/aah · PACKAGE
pkg.go.dev/vuln/GO-2020-0033 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free