{"id":"CVE-2022-35920","aliases":["EUVD-2022-6514","GHSA-8cw9-5hmv-77w6","PYSEC-2026-918"],"status":"published","title":"Improper Limitation of a Pathname to a Restricted Directory in sanic","description":"Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01199,"percentile":0.6837,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-08-01T21:35:27Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"PyPI","package":"sanic","fixed_in":["22.6.1","21.12.2","20.12.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"sanic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.0"},{"fixed":"22.6.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"sanic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0"},{"fixed":"21.12.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"sanic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"sanic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.0"},{"fixed":"22.6.1"}]}],"versions":["22.3.0","22.3.1","22.3.2","22.6.0"]},{"source":"osv","ecosystem":"PyPI","package":"sanic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0"},{"fixed":"21.12.2"}]}],"versions":["21.12.0","21.12.1","21.3.0","21.3.1","21.3.2","21.3.4","21.6.0","21.6.1","21.6.2","21.9.0","21.9.1","21.9.2","21.9.3"]},{"source":"osv","ecosystem":"PyPI","package":"sanic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.7"}]}],"versions":["0.1.0","0.1.1","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.4","0.6.0","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","18.12.0","19.12.0","19.12.2","19.12.3","19.12.4","19.12.5","19.3.1","19.6.0","19.6.2","19.6.3","19.9.0","20.12.0","20.12.1","20.12.2","20.12.3","20.12.4","20.12.5","20.12.6","20.3.0","20.6.0","20.6.1","20.6.2","20.6.3","20.9.0","20.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"sanic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.7"},{"introduced":"22.0.0"},{"fixed":"22.6.1"},{"introduced":"21.0.0"},{"fixed":"21.12.2"}]}],"versions":["0.1.0","0.1.1","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.4","0.6.0","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","18.12.0","19.12.0","19.12.2","19.12.3","19.12.4","19.12.5","19.3.1","19.6.0","19.6.2","19.6.3","19.9.0","20.12.0","20.12.1","20.12.2","20.12.3","20.12.4","20.12.5","20.12.6","20.3.0","20.6.0","20.6.1","20.6.2","20.6.3","20.9.0","20.9.1","21.12.0","21.12.1","21.3.0","21.3.1","21.3.2","21.3.4","21.6.0","21.6.1","21.6.2","21.9.0","21.9.1","21.9.2","21.9.3","22.3.0","22.3.1","22.3.2","22.6.0"]}],"products":[{"vendor":"sanic-org","product":"sanic"},{"vendor":"sanic_project","product":"sanic"}],"references":[{"url":"https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/sanic-org/sanic/issues/2478","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/sanic-org/sanic/pull/2495","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35920","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8cw9-5hmv-77w6","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35920.json","tags":["advisory"]},{"url":"https://github.com/sanic-org/sanic","tags":["package"]},{"url":"https://pypi.org/project/sanic","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-35920","title":"Improper Limitation of a Pathname to a Restricted Directory in sanic","description":"Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.","status":"published","published":"2022-08-01T21:35:27Z","modified":"2025-04-22T17:45:43.669Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-6514","description":"Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.","status":"published","published":"2022-08-01T21:35:27Z","modified":"2025-04-22T17:45:43Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:15.540112Z"}],"ghsa":[{"id":"GHSA-8cw9-5hmv-77w6","title":"sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs","description":"### Impact\nAccess to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted.\n\n### Patches\n- v20.12.7 (LTS)\n- v21.12.2 (LTS)\n- v22.6.1\n\n### References\nhttps://github.com/sanic-org/sanic/issues/2478\nhttps://github.com/sanic-org/sanic/pull/2495\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the community forums](https://community.sanicframework.org/)\n* Ping us on [the Discord server](https://discord.gg/FARQzAEMAA)\n\n","status":"published","published":"2022-08-06T05:21:19Z","modified":"2023-01-31T05:01:32Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:29.100018Z"}],"nvd":[{"id":"CVE-2022-35920","description":"Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.","status":"published","published":"2022-08-01T22:15:10.347Z","modified":"2026-06-17T04:52:31.36Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"CVE-2022-35920","title":"Improper Limitation of a Pathname to a Restricted Directory in sanic","description":"Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.","status":"published","published":"2022-08-01T21:35:27Z","modified":"2026-10-28T02:30:45.307340818Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-8cw9-5hmv-77w6","title":"sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs","description":"### Impact\nAccess to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted.\n\n### Patches\n- v20.12.7 (LTS)\n- v21.12.2 (LTS)\n- v22.6.1\n\n### References\nhttps://github.com/sanic-org/sanic/issues/2478\nhttps://github.com/sanic-org/sanic/pull/2495\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the community forums](https://community.sanicframework.org/)\n* Ping us on [the Discord server](https://discord.gg/FARQzAEMAA)\n\n","status":"published","published":"2022-08-06T05:21:19Z","modified":"2026-07-07T11:56:31.184791676Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"PYSEC-2026-918","title":"sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs","description":"### Impact\nAccess to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted.\n\n### Patches\n- v20.12.7 (LTS)\n- v21.12.2 (LTS)\n- v22.6.1\n\n### References\nhttps://github.com/sanic-org/sanic/issues/2478\nhttps://github.com/sanic-org/sanic/pull/2495\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the community forums](https://community.sanicframework.org/)\n* Ping us on [the Discord server](https://discord.gg/FARQzAEMAA)\n\n","status":"published","published":"2026-07-06T08:03:31.763289Z","modified":"2026-07-07T11:45:50.826682501Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"}]}}