CVE-2020-15111: CRLF vulnerability in Fiber

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-20 · updated 2026-06-17
Weakness: CWE-74

Description

In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment().

Affected products

gofiber fiber: before 1.12.6 — fixed in 1.12.6

How to fix

Upgrade to a fixed version: gofiber fiber 1.12.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-15111 or the next vulnerability affects your stack