CVE-2022-35920

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-359214.3fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by CVE-2022-359227.5Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an ou CVE-2022-359237.5v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in th CVE-2022-359249.1NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` CVE-2022-359259.8BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which al CVE-2022-359267.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery CVE-2022-359279.8Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Con CVE-2022-359285.5AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version CVE-2022-359299.8cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation ex CVE-2022-359308.8PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will r CVE-2022-359312.7Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, CVE-2022-359325.3Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected convers