Description (CNA)
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / cesanta/mongoose | affected unspecified before 7.6 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-UNMANAGED-CESANTAMONGOOSE-2404180
- https://github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487ab0aaae9e8f6b439335945
ADP enrichment
No English description supplied.