CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2020-36559
High (7.5) in aahframework aah. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in github.com/go-aah/aah 0.12.4.
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- aahframework:aah
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vp56-r7qv-783v | Go | github.com/go-aah/aah | <0.12.4 | 0.12.4 |
| GHSA-vp56-r7qv-783v | Go | aahframe.work | <0.12.4 | 0.12.4 |
| GO-2020-0033 | Go | aahframe.work | <0.12.4 | 0.12.4 |