critical9.3
CVE-2022-31558
Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely
Impact
The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | shiva | <= 0.10.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Shiva-Server Project | Shiva-Server | through 0.10.0 |