Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-26652 BIT-nats-2022-26652EUVD-2022-1345GHSA-6h3m-36w8-hv68GO-2022-0351

Arbitrary file write in nats-server

Published Mar 10, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Package: github.com/nats-io/nats-server Package: github.com/nats-io/nats-server/v2 Package: github.com/nats-io/nats-streaming-server Ecosystem: Go

Description

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/nats-io/nats-server all versions — GO-2022-0351
Go github.com/nats-io/nats-server/v2 >= 2.2.0, < 2.7.4 2.7.4 GHSA-6h3m-36w8-hv68
Go github.com/nats-io/nats-streaming-server >= 0.15.0, < 0.24.3 0.24.3 GHSA-6h3m-36w8-hv68

References