{"id":"GHSA-fw3x-2pr2-5j64","aliases":["CVE-2012-3521"],"title":"GeSHi vulnerable to Directory Traversal","description":"Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) geshi-path or (2) geshi-lang-path parameter.","severity":"high","score":8.7,"published":"2022-05-17T04:42:16.000Z","modified":"2025-04-14T16:42:07.106Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"geshi/geshi","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.8.11"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.0.8.11"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2012-3521","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=685324","https://github.com/GeSHi/geshi-1.0","http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105247.html","http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105273.html","http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105317.html","http://sourceforge.net/p/geshi/code/2507","http://www.openwall.com/lists/oss-security/2012/08/21/11"],"sources":[{"name":"OSV","id":"GHSA-fw3x-2pr2-5j64","modified":"2025-04-14T16:42:07.106169Z","url":"https://osv.dev/vulnerability/GHSA-fw3x-2pr2-5j64"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7}]}