Flask-Cors Directory Traversal vulnerability
High severity
GitHub Reviewed
Published
May 6, 2021
to the GitHub Advisory Database
•
Updated Aug 31, 2023
Description
Published by the National Vulnerability Database
Aug 31, 2020
Reviewed
May 5, 2021
Published to the GitHub Advisory Database
May 6, 2021
Last updated
Aug 31, 2023
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows
../
directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.References