GHSA-vp56-r7qv-783v
ahh vulnerable to Path Traversal
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/go-aah/aah | < 0.12.4 | 0.12.4 |
| Go | aahframe.work | < 0.12.4 | 0.12.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
Due to improper santization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
References
External links from the advisory. They lead to third-party sites.