GHSA-qp72-96p2-g644

Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-31558

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	shiva	<= 0.10.0	no fix listed

As written in the advisory (Markdown source, shown as plain text).

The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

External links from the advisory. They lead to third-party sites.