{"id":"CVE-2020-7647","details":"All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.","aliases":["GHSA-px9h-x66r-8mpc"],"modified":"2026-07-08T22:14:48.683948Z","published":"2020-05-11T20:15:12.463Z","related":["SNYK-JAVA-IOJOOBY-568806,","SNYK-JAVA-ORGJOOBY-568807,"],"references":[{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806%2C"},{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807%2C"},{"type":"FIX","url":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jooby-project/jooby","events":[{"introduced":"0"},{"fixed":"9939f28218cf4bc686817f4e71d35ceaa4f7a891"},{"introduced":"6599885a736e4ad2962e0f68ae871933735c532e"},{"fixed":"336d17c409a685b6c1c8913137c2844af3fa7bb0"},{"fixed":"34f526028e6cd0652125baa33936ffb6a8a4a009"}],"database_specific":{"cpe":"cpe:2.3:a:jooby:jooby:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.6.7"},{"introduced":"2.0.0"},{"fixed":"2.8.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.8.1","v2.8.0","v2.7.3","v2.7.2","v2.7.1","v2.7.0","v2.6.2","v2.6.0","v2.5.1","v2.5.0","v2.4.0","v1.6.6","v1.6.5","v2.3.1","v2.3.0","v2.2.1","v1.6.4","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v1.6.3","v2.0.2","v2.0.1","v2.0.0","v1.6.2","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.0","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v1.0.0.CR8","v1.0.0.CR7","v1.0.0.CR6","v1.0.0.CR5","v1.0.0.CR4","v1.0.0.CR3","v1.0.0.CR2","v1.0.0.CR1","v0.16.0","v0.15.1","v0.15.0","v0.14.0","v0.11.2","v0.11.1","v0.11.0","v0.10.0","v0.9.2","v0.9.1","v0.9.0","v0.8.2","v0.8.0","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.3","v0.5.1","v0.5.0","v0.4.2","v0.4.1","v0.4.0","v0.3.0","v0.2.1","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7647.json","vanir_signatures_modified":"2026-07-08T22:14:48Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["212552517428712157371467294294585534240","147093936128643861626990937998929825099","161455699441314924120019767760285523768","225399757400529951307103118832631518208"],"threshold":0.9},"id":"CVE-2020-7647-2cce24e8","signature_type":"Line","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/main/java/org/jooby/Jooby.java"}},{"deprecated":false,"digest":{"line_hashes":["161619109476583297538546584396719559462","220039322242277197365860230397327887748","23197574679396418500192664508841220059","65751704212995262998810260667210623569","264603164129503081438426995548196204090","329663273969106577944675263073166033549","271367844159015131077658879843940319519","162455263896057661585712066696501288338","64436418796746477026928314336012688988","272045558569696631772089029432072281995","121739595361313449345920558893233621020","26395294751276038574201073044052649795","229041600862413423664493720794080674357","148836473539862667371261588267637031920","306300835907094780300756537667847270203","161681231023083642698991046532814073966","154801049179100275768052150209375399419","13337740928175159383871802720892469121","199488054425381468054538460581216835579","272542966393869661927810074844494860565","50042127032734271336388324578295823012","115654318111499550427623890756851905634","276408233463882900729839658855231389318","308339223633298911252630915387257889266","180437011347013350230916310624629527575","28895953695910666067238604729251102470","218737858211990339887217685854071993855","15296571052605611714687845280881085534","316720368426529447815056177202755578995","278236535212490069415049092537919085430","101427733571512144937033309081206587525","147285870288971744045186813021497054603","40670676738936615326054506128610124224","333515045724905617093214801044397208582","210082053890601755083962114675563577996","232646768052481782671538411414671815158","191544610789149892934615371126359611954","83539619261385748655790012120573156009","227727047672855215105371381322717471285","314858372333437310684698453091410413951","302678399828485981790394170664615192978","69439438098781601605909005642564275576","289988596854226553567450107391494496419","111594317736714586322150672087582886657","329546962189922269897845170613506560139","101427733571512144937033309081206587525","147285870288971744045186813021497054603","40670676738936615326054506128610124224","333515045724905617093214801044397208582"],"threshold":0.9},"id":"CVE-2020-7647-30c3acbe","signature_type":"Line","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/test/java/org/jooby/handlers/AssetHandlerTest.java"}},{"deprecated":false,"digest":{"function_hash":"75241057967001708543721281957661057318","length":389},"id":"CVE-2020-7647-3fbc3f0f","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/main/java/org/jooby/handlers/AssetHandler.java","function":"loader"}},{"signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/main/java/org/jooby/handlers/AssetHandler.java"},"deprecated":false,"digest":{"line_hashes":["284322350492569361203734506765649291170","136827093381037059458616376707787565962","264303008917597091803557587115075696055","60391094099022606629608330065167045945","61801825286571956707359707498359713253","33526670066593473929596474822226528361","205403165638214790779260225634952758325","193489442842971561582292454855587077646","20442799290840717143268826577120657286","93986543121478937779861963432483137076","305291025028798569154029860022920087669","285335777361558924081872405524180021298","78342945295682891454935020018671613060","223419838728779314055983705709925705980","324551429510142990401124741168193164829","278320749890395878115291678375008741950","205183241704002128945135423206533714404","59052504140460411738338378794719648349","289065534069548466962947460895581151534","183611433890964603668251361930555441292","311308161950726684996214519692419857381","187298452861405541684825886488057519378","279281705128073278619715575461867803478","305395475114309386361540186419582807776","74012423974450463777487136179838645657","159171285040264884613342277930255316955","77660057087804913031363862899427491295","788229357149381105200211785686573652","179480269685709459926430911818804209249","126876795071536668615007228950638352250","50427289188281236132518963613984548263","214550049168712985641314749541024311605","247634509453895134292997914189489175492","255148454907132289276295066772800706345","148382419024157856204569456260564274626","288005860740605738608869021571912389044","619578806602993429146164857448611813","278896089546321282352813780308131577181","92068565714551165840960895930518440685","5725240016021211540320050202163470958","204660894949651229210459101273848472453","154483012249047875615819488984073941922","169143056989761286289151985313700935246","203194016462557195739070119297283820310","82828110035805884975016328122102661148"],"threshold":0.9},"id":"CVE-2020-7647-4090357a","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/main/java/org/jooby/Route.java"},"deprecated":false,"digest":{"line_hashes":["52148661555948863435409834028586203781","184588606516991175512448254941564428088","263012345203460402638656135733543809824","169156186728749097061692794176810427175"],"threshold":0.9},"id":"CVE-2020-7647-501d60fa"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"function":"AssetHandler","file":"jooby/src/main/java/org/jooby/handlers/AssetHandler.java"},"deprecated":false,"digest":{"function_hash":"254581573106088760683469565324234339652","length":94},"id":"CVE-2020-7647-63b39f70"},{"target":{"file":"modules/jooby-assets/src/main/java/org/jooby/assets/Assets.java"},"deprecated":false,"digest":{"line_hashes":["331662337386970174962454510193855227212","134031160254590619306537787746623124145","169123550308704033040542670929144006853","106566741536656472393723582151532260825"],"threshold":0.9},"id":"CVE-2020-7647-81a91246","signature_type":"Line","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009"},{"id":"CVE-2020-7647-8d26ad11","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/test/java/org/jooby/handlers/AssetHandlerTest.java","function":"shouldCallParentOnMissing"},"deprecated":false,"digest":{"function_hash":"196924709567893721070102555563098996456","length":519}},{"id":"CVE-2020-7647-a7a9a41e","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/main/java/org/jooby/handlers/AssetHandler.java","function":"AssetHandler"},"deprecated":false,"digest":{"function_hash":"131057297732683348926529263260131709388","length":138}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/test/java/org/jooby/handlers/AssetHandlerTest.java","function":"ignoreMalformedURL"},"deprecated":false,"digest":{"length":669,"function_hash":"218380327951740662995268275220733732761"},"id":"CVE-2020-7647-c0829416"},{"signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/main/java/org/jooby/Route.java","function":"AssetDefinition"},"deprecated":false,"digest":{"function_hash":"221043030479498978702136822320930078165","length":130},"id":"CVE-2020-7647-dfeb46d1","signature_type":"Function"},{"deprecated":false,"digest":{"length":365,"function_hash":"27204629277782650604377669985330048389"},"id":"CVE-2020-7647-ed73fd86","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"function":"customClassloader","file":"jooby/src/test/java/org/jooby/handlers/AssetHandlerTest.java"}},{"deprecated":false,"digest":{"function_hash":"253752291365241395640510288289306821889","length":363},"id":"CVE-2020-7647-efdb4000","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009","target":{"file":"jooby/src/main/java/org/jooby/handlers/AssetHandler.java","function":"init"}},{"target":{"file":"jooby/src/main/java/org/jooby/handlers/AssetHandler.java","function":"AssetHandler"},"deprecated":false,"digest":{"function_hash":"292608528522259998917157987719629665065","length":136},"id":"CVE-2020-7647-f693b473","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}