{"id":"CVE-2022-31509","details":"The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.","modified":"2026-08-12T03:51:33.375648368Z","published":"2022-07-11T00:54:17Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31509.json","unresolved_ranges":[{"source":"DESCRIPTION","extracted_events":[{"fixed":"1.0.1"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31509.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31509"},{"type":"REPORT","url":"https://github.com/github/securitylab/issues/669#issuecomment-1117265726"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/iedadata/usap-dc-website","events":[{"introduced":"0"},{"last_affected":"d19c4869d41c0f29a883f1c40edd0a88248a4360"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:iedadata:usap-dc_web_submission_and_dataset_search:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.0.1"}]}}],"versions":["1.0.1","1.0.0","1.1","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31509.json"}}],"schema_version":"1.9.0"}