Description (CNA)
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This vulnerability is fixed in 1.17.6.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| xyproto / algernon | affected < 1.17.6 |
CWE
CWE-22
References
- https://github.com/xyproto/algernon/security/advisories/GHSA-2j2c-pv62-mmcp
- https://github.com/xyproto/algernon/issues/172
ADP enrichment
No English description supplied.
No references supplied.