{"id":"CVE-2019-25073","aliases":["GHSA-fjgq-224f-fq37","GO-2020-0032"],"url":"https://o3.security/vulnerability/CVE-2019-25073","summary":"Goa vulnerable to path traversal","details":"Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.","published":"2022-12-27T22:15:11.397Z","modified":"2026-07-08T20:05:22.288467Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Go","name":"github.com/goadesign/goa","fixedVersion":"1.4.3"},{"ecosystem":"Go","name":"goa.design/goa","fixedVersion":"1.4.3"},{"ecosystem":"Go","name":"goa.design/goa/v3","fixedVersion":"3.0.9"}],"fix":{"url":"https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39","label":"goadesign/goa@70b5a19"},"references":[{"type":"ADVISORY","url":"https://pkg.go.dev/vuln/GO-2020-0032"},{"type":"FIX","url":"https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39"},{"type":"EVIDENCE","url":"https://github.com/goadesign/goa/pull/2388"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T20:05:22.288467Z"}}