PT-2024-40545 · Unknown+2 · Goyave.Dev/Goyave/V5/Util/Fsutil+2
Published
2024-12-13
·
Updated
2024-12-13
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
Go application using router.Static and osfs.FS (affected versions not specified)
Description:
The issue allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go application has read access to the requested file.
Recommendations:
As a workaround, use fsutil.NewEmbed(embeddedFS) from the goyave.dev/goyave/v5/util/fsutil package to serve static content using Router.Static instead of &osfs.FS. This will ensure that the embedded file systems are rooted to the specified directory, making it impossible to navigate outside of the developers' intended directory.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Go
Goyave.Dev/Goyave/V5/Util/Fsutil
Osfs.Fs