CVE-2020-36559 json
Path Traversal in aahframe.work
published 2021-04-14 5 y ago modified 2026-06-17 4 mo ago also GHSA-vp56-r7qv-783v , GO-2020-0033 , EUVD-2022-7748
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Patch / fix
- go github.com/go-aah/aah 0.12.4
- go aahframe.work 0.12.4
- aahframe.work aahframe.work 0.12.4
- github.com/go-aah/aah@881dc9f commit
- github.com/go-aah/aah#267 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/go-aah/aah | <0.12.4 |
0.12.4 |
| go | aahframe.work | <0.12.4 |
0.12.4 |
Affected products
- aahframe.work aahframe.work
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/go-aah/aah/pull/267
web, third-party-advisory, patch
-
github.com
/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec
web, patch, third-party-advisory
-
github.com
/go-aah/aah/issues/266
web, issue-tracking, third-party-advisory, report
-
pkg.go.dev
/vuln/GO-2020-0033
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-36559
advisory
-
github.com
/go-aah/aah
package
Sources
- CVE List CVE-2020-36559
- GitHub Advisory GHSA-vp56-r7qv-783v
- NVD CVE-2020-36559
- OSV GO-2020-0033
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.