CVE-2021-23772: Arbitrary File Write
This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-23772?
CVE-2021-23772 has been classified as a medium severity vulnerability due to its potential impact on file upload security.
How do I fix CVE-2021-23772?
To fix CVE-2021-23772, update to the latest version of the Iris framework that addresses the file upload handling issue.
Who is affected by CVE-2021-23772?
CVE-2021-23772 affects all versions of the Iris framework, including versions up to 12.1.8 and 12.2.0-alpha series.
What is the nature of the vulnerability in CVE-2021-23772?
CVE-2021-23772 relates to the unsafe handling of file names during upload, allowing attackers to exploit this to write to arbitrary locations.
Is CVE-2021-23772 still a risk in newer releases of Iris?
No, CVE-2021-23772 is not a risk in the latest releases of the Iris framework that have implemented proper file upload security measures.