GHSA-j453-hm5x-c46w
Echo vulnerable to directory traversal
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/labstack/echo/v4 | < 4.2.0 | 4.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
References
External links from the advisory. They lead to third-party sites.