{"id":"CVE-2020-15230","aliases":["EUVD-2023-1889","GHSA-vcvg-xgr8-p5gq"],"status":"published","title":"Arbitrary file read un Vapor","description":"Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0153,"percentile":0.74928,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2020-10-02T18:55:14Z","modified":"2026-10-20T10:51:56Z","fixes":[{"ecosystem":"SwiftURL","package":"github.com/vapor/vapor","fixed_in":["4.29.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"SwiftURL","package":"github.com/vapor/vapor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-rc.2.5"},{"fixed":"4.29.4"}]}]},{"source":"osv","ecosystem":"SwiftURL","package":"github.com/vapor/vapor","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0-rc.2.5"},{"fixed":"4.29.4"}]}]}],"products":[{"vendor":"vapor","product":"vapor"},{"vendor":"vapor_project","product":"vapor"}],"references":[{"url":"https://github.com/vapor/vapor/security/advisories/GHSA-vcvg-xgr8-p5gq","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/vapor/vapor/pull/2500","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/vapor/vapor/commit/cf1651f7ff76515593f4d8ca6e6e15d2247fe255","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15230","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vcvg-xgr8-p5gq"},{"url":"https://github.com/vapor/vapor","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-15230","title":"Arbitrary file read un Vapor","description":"Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.","status":"published","published":"2020-10-02T18:55:14Z","modified":"2024-08-04T13:08:22.827Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2023-1889","description":"Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.","status":"published","published":"2020-10-02T18:55:14Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-vcvg-xgr8-p5gq","title":"Arbitrary file read using percent-encoded relative paths in FileMiddleware","description":"### Impact\n\nAttackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`.\n\n### Patches\n\nVersion [4.29.4](https://github.com/vapor/vapor/releases/tag/4.29.4)\n\n### Workarounds\n\nUpgrade to 4.24.4 or later, or disable `FileMiddleware`.\n\n### References\n\n* Introduced in https://github.com/vapor/vapor/pull/2223\n* Fixed by https://github.com/vapor/vapor/pull/2500\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open [an issue](https://github.com/vapor/vapor/issues)\n* Email us at [security@vapor.codes](mailto:security@vapor.codes)","status":"published","published":"2023-06-09T19:31:32Z","modified":"2023-06-19T16:45:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:55.184601Z"}],"nvd":[{"id":"CVE-2020-15230","description":"Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.","status":"published","published":"2020-10-02T19:15:12.963Z","modified":"2026-06-17T02:56:19.147Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-15230","description":"Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.","status":"published","published":"2020-10-02T19:15:12.963Z","modified":"2026-10-20T10:51:56.330019607Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-vcvg-xgr8-p5gq","title":"Arbitrary file read using percent-encoded relative paths in FileMiddleware","description":"### Impact\n\nAttackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`.\n\n### Patches\n\nVersion [4.29.4](https://github.com/vapor/vapor/releases/tag/4.29.4)\n\n### Workarounds\n\nUpgrade to 4.24.4 or later, or disable `FileMiddleware`.\n\n### References\n\n* Introduced in https://github.com/vapor/vapor/pull/2223\n* Fixed by https://github.com/vapor/vapor/pull/2500\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open [an issue](https://github.com/vapor/vapor/issues)\n* Email us at [security@vapor.codes](mailto:security@vapor.codes)","status":"published","published":"2023-06-09T19:31:32Z","modified":"2026-07-08T06:00:43.20051034Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}