CVE-2022-29970

Published May 2nd, 2022

View on NVD ↗

CVSS v3

7.5

HIGH

CVSS v2

5

MEDIUM

Affected

1

PROJECT

Description

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

sinatra/sinatra

Classy web-development dressed in a DSL (official / canonical repo)

GitHub

12.4K