critical9.8
CVE-2023-1800
sjqzhang go-fastdfs vulnerable to path traversal
Impact
sjqzhang go-fastdfs up to 1.4.3 is vulnerable to path traversal in the function upload of the file `/group1/upload` of the component `File Upload Handler`. The attack may be launched remotely and the exploit has been disclosed to the public and may be used.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/sjqzhang/go-fastdfs | < 1.4.5-0.20230408141131-61cbff5124c6 | 1.4.5-0.20230408141131-61cbff5124c6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Go-Fastdfs Project | Go-Fastdfs | through 1.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/yangyanglo/ForCVE/blob/main/2023-0x05.md
- https://vuldb.com/?ctiid.224768
- https://vuldb.com/?id.224768
- https://github.com/advisories/GHSA-xq3x-grrj-fj6x
- https://nvd.nist.gov/vuln/detail/CVE-2023-1800
- https://github.com/sjqzhang/go-fastdfs/commit/61cbff5124c61e292994099372b11c06cdb5b80b
- https://github.com/yangyanglo/ForCVE/blob/93a16663cd32a36d37d8a0f0102e1592254d0279/2023-0x05.md