Skip to content
OpenAdvisories
High · 7.5 CVE-2019-25073 EUVD-2022-7619GHSA-fjgq-224f-fq37GO-2020-0032

Path traversal in github.com/goadesign/goa

Published Dec 27, 2022 · Updated Apr 11, 2025 · Assigned by Go

Vendor: github.com/goadesign/goa Vendor: goa.design/goa Vendor: goa.design/goa/v3 Product: github.com/goadesign/goa Product: goa.design/goa Product: goa.design/goa/v3 Package: github.com/goadesign/goa Package: goa.design/goa Package: goa.design/goa/v3 Ecosystem: Go

Description

Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.

Affected products

VendorProductAffectedFixed
github.com/goadesign/goa github.com/goadesign/goa < 1.4.3 1.4.3
goa.design/goa goa.design/goa < 1.4.3 1.4.3
goa.design/goa/v3 goa.design/goa/v3 < 3.0.9 3.0.9

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/goadesign/goa < 1.4.3 1.4.3 GHSA-fjgq-224f-fq37
Go goa.design/goa < 1.4.3 1.4.3 GHSA-fjgq-224f-fq37
Go goa.design/goa/v3 < 3.0.9 3.0.9 GHSA-fjgq-224f-fq37

References