{"id":"GHSA-rrhw-54r8-545q","aliases":["CVE-2022-1850"],"title":"Path Traversal in FileGator","description":"Path Traversal in FileGator prior to 7.8.0 for non-admin users. Files created with `..\\` as part of their name will be interpreted as a path. Users are thus able to add filesystem entries outside the scope of their user to their dashboard and subsequently are able to modify those files.","severity":"medium","score":5.4,"published":"2022-05-25T00:00:39.000Z","modified":"2023-11-08T04:07:51.639Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"filegator/filegator","ranges":[{"events":[{"introduced":"0"},{"fixed":"7.8.0"}],"type":"ECOSYSTEM"}],"versions":["v7.0.0","v7.0.0-RC1","v7.0.0-RC2","v7.0.0-RC3","v7.0.1","v7.1.0","v7.1.1","v7.1.2","v7.1.3","v7.1.4","v7.1.5","v7.1.6","v7.2.0","v7.2.1","v7.3.0","v7.3.1","v7.3.2","v7.3.3","v7.3.4","v7.3.5","v7.4.0","v7.4.1","v7.4.2","v7.4.3","v7.4.4","v7.4.5","v7.4.6","v7.4.7","v7.5.0","v7.5.1","v7.5.2","v7.5.3","v7.6.0","v7.7.0","v7.7.1","v7.7.2"],"fixed":["7.8.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-1850","https://github.com/filegator/filegator/commit/6e2b68f17f48cdc1d6a4a93a2369d2069fe64989","https://github.com/filegator/filegator","https://huntr.dev/bounties/07755f07-a412-4911-84a4-2f8c03c8f7ce"],"sources":[{"name":"OSV","id":"GHSA-rrhw-54r8-545q","modified":"2023-11-08T04:07:51.639686Z","url":"https://osv.dev/vulnerability/GHSA-rrhw-54r8-545q"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4}]}