CVE-2022-35920: sanic project sanic

csirt@kutim:~/threat-intel/cve/CVE-2022-35920

CVSS 7.5 · High EPSS 1,2%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada sanic project sanic. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.

Rincian

Terbit di NVD: 1 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 66,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sanic project	sanic	Semua versi sebelum 20.12.7
sanic project	sanic	Versi 21.0.0 hingga sebelum 21.12.2
sanic project	sanic	Versi 22.0.0 hingga sebelum 22.6.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/sanic-org/sanic/pull/2495 patch · advisory pihak ketiga
https://github.com/sanic-org/sanic/issues/2478 exploit · issue tracking · advisory pihak ketiga
https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.