GHSA-vcvg-xgr8-p5gq
Arbitrary file read using percent-encoded relative paths in FileMiddleware
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| SwiftURL | github.com/vapor/vapor | >= 4.0.0-rc.2.5, < 4.29.4 | 4.29.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Attackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`.
### Patches
Version [4.29.4](https://github.com/vapor/vapor/releases/tag/4.29.4)
### Workarounds
Upgrade to 4.24.4 or later, or disable `FileMiddleware`.
### References
* Introduced in https://github.com/vapor/vapor/pull/2223
* Fixed by https://github.com/vapor/vapor/pull/2500
### For more information
If you have any questions or comments about this advisory:
* Open [an issue](https://github.com/vapor/vapor/issues)
* Email us at [[email protected]](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.