Description
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | iodine | < 0.7.33 | 0.7.33 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | iodine | < 0.7.34 | 0.7.34 | GHSA-85rf-xh54-whp3 |
References
- GitHub Security Advisory (GHSA-85rf-xh54-whp3) vendor-advisory
- https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889 patch
- GitHub Security Advisory (GHSA-85rf-xh54-whp3) vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3 third-party-advisory