GHSA-3jhm-87m6-x959
Path traversal mitigation bypass in OctoRPKI
Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.
Specific Go Packages Affected
github.com/cloudflare/cfrpki/cmd/octorpki
Patches
The issue was fixed in version 1.4.3
References
What each source reports
GitHub AdvisoriesNo score
Path traversal mitigation bypass in OctoRPKI
Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.
Specific Go Packages Affected
github.com/cloudflare/cfrpki/cmd/octorpki
Patches
The issue was fixed in version 1.4.3
References
- Record
GHSA-3jhm-87m6-x959- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVNo score
Path traversal mitigation bypass in OctoRPKI
Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.
Specific Go Packages Affected
github.com/cloudflare/cfrpki/cmd/octorpki
Patches
The issue was fixed in version 1.4.3
References
- Record
GHSA-3jhm-87m6-x959- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGO-2022-0496No score
Path traversal mitigation bypass in OctoRPKI in github.com/cloudflare/cfrpki
Path traversal mitigation bypass in OctoRPKI in github.com/cloudflare/cfrpki
- Record
GO-2022-0496- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cloudflare/cfrpkiGo | before 1.4.3 | 1.4.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-3jhm-87m6-x959 is a vulnerability with no CVSS score yet in github.com/cloudflare/cfrpki, published June 25, 2022. No source lists public exploit code. Fixed in github.com/cloudflare/cfrpki 1.4.3.