CVE-2021-23772

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	github.com/kataras/iris	< unspecified
n/a	github.com/kataras/iris/v12	< unspecified

References

https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170Exploit, Patch, Third Party Advisory
https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170Exploit, Patch, Third Party Advisory

Timeline

Published: Dec 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23787.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-237846.1This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without bein CVE-2021-237929.8The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecure CVE-2021-237979.8All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.CVE-2021-23807.6Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Supported vers CVE-2021-238039.8This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application CVE-2021-238079.8This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix CVE-2021-23813.9Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily expl CVE-2021-238148.8This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the fil CVE-2021-23829.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected CVE-2021-238209.8This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer com CVE-2021-238246.1This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to in