CVE-2020-36559: Path Traversal in aahframe.work

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-27 · updated 2026-06-17
Weakness: CWE-22

Description

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

Affected products

aahframe.work: before 0.12.4 — fixed in 0.12.4

How to fix

Upgrade to a fixed version: aahframe.work 0.12.4. Check the vendor advisory for mitigations.

References

https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec
https://github.com/go-aah/aah/issues/266
https://github.com/go-aah/aah/pull/267
https://pkg.go.dev/vuln/GO-2020-0033
https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec
https://github.com/go-aah/aah/issues/266
https://github.com/go-aah/aah/pull/267
https://pkg.go.dev/vuln/GO-2020-0033

Get alerted when CVE-2020-36559 or the next vulnerability affects your stack