What’s Vulnerable › Vulnerabilities

CVE-2019-25073: Path traversal in github.com/goadesign/goa

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-27 · updated 2026-06-17
• Weakness: CWE-22

Description

Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.

Affected products

• Goa.Design Goa: before 1.4.3; from 2.0.0 before 2.0.10; from 3.0.0 before 3.0.9 — fixed in 1.4.3, 2.0.10, 3.0.9

How to fix

Upgrade to a fixed version: Goa.Design Goa 1.4.3, 2.0.10, 3.0.9. Check the vendor advisory for mitigations.

References

• https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39
• https://github.com/goadesign/goa/pull/2388
• https://pkg.go.dev/vuln/GO-2020-0032
• https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39
• https://github.com/goadesign/goa/pull/2388
• https://pkg.go.dev/vuln/GO-2020-0032

Get alerted when CVE-2019-25073 or the next vulnerability affects your stack