{"id":"CVE-2022-31539","details":"The kotekan/kotekan repository through 2021.11 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.","modified":"2026-08-12T03:51:11.470571739Z","published":"2022-07-11T00:57:36Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"2021.11"}],"source":"DESCRIPTION"}],"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31539.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31539.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31539"},{"type":"REPORT","url":"https://github.com/github/securitylab/issues/669#issuecomment-1117265726"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kotekan/kotekan","events":[{"introduced":"0"},{"last_affected":"0d2ed553d25fb621893b5837c9c68c9a74539c25"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:kotekan_project:kotekan:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2021.11"}]}}],"versions":["2021.11f","2021.11e","2021.11","2021.11d","2021.11c","2021.11b","2021.11a","2021.10","2021.03b","2021.03a","2021.03","2020.11b","2020.11a","2020.11","2020.10","2020.06c","2020.06b","2020.06a","2020.06","2020.04a","2020.04","2019.12b","2019.12a","2019.12","2019.10a","2019.10","2019.08","2019.07","2019.05","2019.03","2018.12b","2018.12a","2018.12","2018.11","2018.10","2018.08a","2018.08","2018.07"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31539.json"}}],"schema_version":"1.9.0"}