CVE-2022-29970: Path Traversal
A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served.
Other sources
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-29970?
CVE-2022-29970 is a vulnerability in the Sinatra web application framework that allows files outside of the public directory to be served when serving static files.
What is the severity level of CVE-2022-29970?
CVE-2022-29970 has a severity level of high (7).
How does CVE-2022-29970 affect Sinatra?
CVE-2022-29970 affects Sinatra by not validating that the expanded path matches the public directory when serving static files.
How can I fix CVE-2022-29970?
To fix CVE-2022-29970, update to Sinatra version 2.2.0 or later.
Are there any references for CVE-2022-29970?
Yes, you can find references for CVE-2022-29970 at the following links: [1] NVD, [2] GitHub - Sinatra, [3] GitHub - Skylight Ruby