Description
This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | github.com/kataras/iris | < unspecified | unspecified |
| — | github.com/kataras/iris/v12 | < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kataras/iris | <= 0.0.2 | — | GHSA-jcxc-rh6w-wf49 |
| Go | github.com/kataras/iris | all versions | — | GO-2022-0272 |
| Go | github.com/kataras/iris/v12 | < 12.2.0-alpha8 | 12.2.0-alpha8 | GHSA-jcxc-rh6w-wf49 |