Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

2 vulnerabilities found for github.com/labstack/echo/v4 by github.com/labstack/echo/v4

CVE-2020-36565 (GCVE-0-2020-36565)

Vulnerability from cvelistv5 – Published: 2022-12-07 16:14 – Updated: 2025-04-23 15:38
VLAI?
Title
Directory traversal on Windows in github.com/labstack/echo/v4
Summary
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE 22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
Go
References
Impacted products
Vendor Product Version
github.com/labstack/echo/v4 github.com/labstack/echo/v4 Affected: 0 , < 4.1.18-0.20201215153152-4422e3b66b9f (semver)
Create a notification for this product.
Credits
@little-cui (Apache ServiceComb)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:30:08.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/labstack/echo/pull/1718"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2021-0051"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-36565",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:38:06.629425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T15:38:30.467Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/labstack/echo/v4",
          "platforms": [
            "windows"
          ],
          "product": "github.com/labstack/echo/v4",
          "programRoutines": [
            {
              "name": "common.static"
            },
            {
              "name": "Echo.Static"
            },
            {
              "name": "Group.Static"
            }
          ],
          "vendor": "github.com/labstack/echo/v4",
          "versions": [
            {
              "lessThan": "4.1.18-0.20201215153152-4422e3b66b9f",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "@little-cui (Apache ServiceComb)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE 22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:06.359Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://github.com/labstack/echo/pull/1718"
        },
        {
          "url": "https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2021-0051"
        }
      ],
      "title": "Directory traversal on Windows in github.com/labstack/echo/v4"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2020-36565",
    "datePublished": "2022-12-07T16:14:43.946Z",
    "dateReserved": "2022-07-29T18:52:35.508Z",
    "dateUpdated": "2025-04-23T15:38:30.467Z",
    "requesterUserId": "7d08541a-cd0a-42e2-8f81-76e6ceb65fc3",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-36565 (GCVE-0-2020-36565)

Vulnerability from nvd – Published: 2022-12-07 16:14 – Updated: 2025-04-23 15:38
VLAI?
Title
Directory traversal on Windows in github.com/labstack/echo/v4
Summary
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE 22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
Go
References
Impacted products
Vendor Product Version
github.com/labstack/echo/v4 github.com/labstack/echo/v4 Affected: 0 , < 4.1.18-0.20201215153152-4422e3b66b9f (semver)
Create a notification for this product.
Credits
@little-cui (Apache ServiceComb)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:30:08.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/labstack/echo/pull/1718"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2021-0051"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-36565",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:38:06.629425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T15:38:30.467Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/labstack/echo/v4",
          "platforms": [
            "windows"
          ],
          "product": "github.com/labstack/echo/v4",
          "programRoutines": [
            {
              "name": "common.static"
            },
            {
              "name": "Echo.Static"
            },
            {
              "name": "Group.Static"
            }
          ],
          "vendor": "github.com/labstack/echo/v4",
          "versions": [
            {
              "lessThan": "4.1.18-0.20201215153152-4422e3b66b9f",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "@little-cui (Apache ServiceComb)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE 22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:06.359Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://github.com/labstack/echo/pull/1718"
        },
        {
          "url": "https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2021-0051"
        }
      ],
      "title": "Directory traversal on Windows in github.com/labstack/echo/v4"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2020-36565",
    "datePublished": "2022-12-07T16:14:43.946Z",
    "dateReserved": "2022-07-29T18:52:35.508Z",
    "dateUpdated": "2025-04-23T15:38:30.467Z",
    "requesterUserId": "7d08541a-cd0a-42e2-8f81-76e6ceb65fc3",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}