GHSA-9h6h-9g78-86f7
Yapscan's report receiver server vulnerable to path traversal and log injection
Impact
If you make use of the report receiver server (experimental), a client may be able to forge requests such that arbitrary files on the host can be overwritten (subject to permissions of the yapscan server), leading to loss of data. This is particularly problematic if you do not authenticate clients and/or run the server with elevated permissions.
Patches
Vulnerable versions:
- v0.18.0
- v0.19.0 (unreleased)
This problem is patched in version v0.19.1
Workarounds
Update to the newer version is highly encouraged!
Measures to reduce the risk of this include authenticating clients (see --client-ca flag) and containerization of the yapscan server.
References
The tracking issue is #35. There you can find the commits, fixing the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
Yapscan's report receiver server vulnerable to path traversal and log injection
Impact
If you make use of the report receiver server (experimental), a client may be able to forge requests such that arbitrary files on the host can be overwritten (subject to permissions of the yapscan server), leading to loss of data. This is particularly problematic if you do not authenticate clients and/or run the server with elevated permissions.
Patches
Vulnerable versions:
- v0.18.0
- v0.19.0 (unreleased)
This problem is patched in version v0.19.1
Workarounds
Update to the newer version is highly encouraged!
Measures to reduce the risk of this include authenticating clients (see --client-ca flag) and containerization of the yapscan server.
References
The tracking issue is #35. There you can find the commits, fixing the issue.
- Record
GHSA-9h6h-9g78-86f7- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22, CWE-73, CWE-117
- Updated
- 2026-11-02
OSV
Yapscan's report receiver server vulnerable to path traversal and log injection
Impact
If you make use of the report receiver server (experimental), a client may be able to forge requests such that arbitrary files on the host can be overwritten (subject to permissions of the yapscan server), leading to loss of data. This is particularly problematic if you do not authenticate clients and/or run the server with elevated permissions.
Patches
Vulnerable versions:
- v0.18.0
- v0.19.0 (unreleased)
This problem is patched in version v0.19.1
Workarounds
Update to the newer version is highly encouraged!
Measures to reduce the risk of this include authenticating clients (see --client-ca flag) and containerization of the yapscan server.
References
The tracking issue is #35. There you can find the commits, fixing the issue.
- Record
GHSA-9h6h-9g78-86f7- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-117, CWE-22, CWE-73
- Updated
- 2026-11-02
OSVGO-2022-1204No score
Yapscan's report receiver server vulnerable to path traversal and log injection in github.com/fkie-cad/yapscan
Yapscan's report receiver server vulnerable to path traversal and log injection in github.com/fkie-cad/yapscan
- Record
GO-2022-1204- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/fkie-cad/yapscanGo | 0.18.0 up to 0.19.1 | 0.19.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9h6h-9g78-86f7 is a high vulnerability (CVSS 7.5) in github.com/fkie-cad/yapscan, published December 29, 2022. No source lists public exploit code. Fixed in github.com/fkie-cad/yapscan 0.19.1.
References
github.com/fkie-cad/yapscan/security/advisories/GHSA-9h6h-9g78-86f7