GHSA-cp67-8w3w-6h9c
Path Traversal
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.keycloak:keycloak-parent | < 12.0.0 | 12.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw
References
External links from the advisory. They lead to third-party sites.