ahh vulnerable to Path Traversal

HOCH 7.5CVE-2020-36559 · GHSA-vp56-r7qv-783v · GO-2020-0033 · Published 27/12/2022 · updated 17/06/2026

Kurz gesagt

CVE-2020-36559 ist eine Schwachstelle (HOCH (CVSS 7.5)) in aahframe.work, github.com/go-aah/aah, aah (aahframework).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.2%, höher als bei 69.3% aller Schwachstellen.
Abhilfe: auf 0.12.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
aahframe.work Go	`< 0.12.4`	`0.12.4`
github.com/go-aah/aah Go	`< 0.12.4`	`0.12.4`
aah aahframework	`< 0.12.4`	`0.12.4`

Description

Due to improper santization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

NVD description

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

References

nvd.nist.gov/vuln/detail/CVE-2020-36559 · ADVISORY
go-aah/aah · WEB
go-aah/aah#267 · WEB
go-aah/aah commit 881dc9f · WEB
go-aah/aah · PACKAGE
pkg.go.dev/vuln/GO-2020-0033 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free