CVE-2020-25032

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00028.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00032.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00039.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00048.htmlMailing List, Third Party Advisory
https://github.com/corydolphin/flask-cors/releases/tag/3.0.9Third Party Advisory
https://www.debian.org/security/2020/dsa-4775Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00028.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00032.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00039.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00048.htmlMailing List, Third Party Advisory
https://github.com/corydolphin/flask-cors/releases/tag/3.0.9Third Party Advisory
https://www.debian.org/security/2020/dsa-4775Third Party Advisory

Timeline

Published: Aug 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-250336.1The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.CVE-2020-250346.5eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, sea CVE-2020-250356.7UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole_client's PHP call, a related issue to CVE CVE-2020-250368.8UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell wit CVE-2020-250378.2UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted command.CVE-2020-250398.1Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execut CVE-2020-25047.5If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed the CVE-2020-250408.8Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations,CVE-2020-250427.2An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated (admin/manager)CVE-2020-250437.1The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to dele CVE-2020-250447.1Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the o CVE-2020-250457.8Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL