CVE-2021-23772

Arbitrary File Write

High · published December 24, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01882 · 79.3th percentile
Published
2021-12-24T12:05Z
EPSS history
Timeline
  • 24 DEC 12:05Z
    Arbitrary File Write
    cvelistv5