CVE-2021-23772

8.8 highEPSS 1.9%

High (8.8) in iris-go iris. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in github.com/kataras/iris/v12 12.2.0-alpha8.

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-59
Published: 2021-12-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

iris-go:iris

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jcxc-rh6w-wf49	Go	github.com/kataras/iris/v12	<12.2.0-alpha8	12.2.0-alpha8
GHSA-jcxc-rh6w-wf49	Go	github.com/kataras/iris	<=0.0.2	no fix published
GO-2022-0272	Go	github.com/kataras/iris/v12	<12.2.0-alpha8	12.2.0-alpha8
GO-2022-0272	Go	github.com/kataras/iris	all versions	no fix published

References

Check your stack JSON