CVE-2020-36559

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
aahframe.work	aahframe.work	< 0.12.4

References

https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ecPatch, Third Party Advisory
https://github.com/go-aah/aah/issues/266Issue Tracking, Third Party Advisory
https://github.com/go-aah/aah/pull/267Third Party Advisory
https://pkg.go.dev/vuln/GO-2020-0033Third Party Advisory
https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ecPatch, Third Party Advisory
https://github.com/go-aah/aah/issues/266Issue Tracking, Third Party Advisory
https://github.com/go-aah/aah/pull/267Third Party Advisory
https://pkg.go.dev/vuln/GO-2020-0033Third Party Advisory

Timeline

Published: Dec 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-36567.8Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices in Snapdrag CVE-2020-365609.1Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the tar CVE-2020-365619.1Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the tar CVE-2020-365627.5Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.CVE-2020-365635.3XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash co CVE-2020-365647.5Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user su CVE-2020-365655.3Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read CVE-2020-365669.1Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the tar CVE-2020-365677.5Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.CVE-2020-365687.5Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memor CVE-2020-365699.1Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-202001311 CVE-2020-36579.8u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client th