CVE-2020-36565

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
github.com/labstack/echo/v4	github.com/labstack/echo/v4	< 4.1.18-0.20201215153152-4422e3b66b9f

References

https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaaPatch, Third Party Advisory
https://github.com/labstack/echo/pull/1718Exploit, Patch, Third Party Advisory
https://pkg.go.dev/vuln/GO-2021-0051Release Notes, Vendor Advisory
https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaaPatch, Third Party Advisory
https://github.com/labstack/echo/pull/1718Exploit, Patch, Third Party Advisory
https://pkg.go.dev/vuln/GO-2021-0051Release Notes, Vendor Advisory

Timeline

Published: Dec 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-365669.1Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the tar CVE-2020-365677.5Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.CVE-2020-365687.5Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memor CVE-2020-365699.1Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-202001311 CVE-2020-36579.8u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client th CVE-2020-36589.1Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute,CVE-2020-365999.8lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.CVE-2020-36609.8Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute,CVE-2020-366007.5Out-of-bounds write vulnerability in the power consumption module. Successful exploitation of this vulnerability may cause the system to res CVE-2020-366017.5Out-of-bounds write vulnerability in the kernel modules. Successful exploitation of this vulnerability may cause a panic reboot.CVE-2020-366026.1There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and CVE-2020-366036.5The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function cal