PyPI/xmpp-http-upload CVE-2020-15239: low 3.5, EPSS 1.87%

Directory Traversal vulnerability in GET/PUT allows attackers to Disclose Information or Write Files via a crafted GET/PUT request

Action: Upgrade xmpp-http-upload to 0.4.0 or later.

pip install xmpp-http-upload==0.4.0

Affected

Fixed versions

Sources

• osv: GHSA-hwv5-w8gm-fq9f
• https://github.com/horazont/xmpp-http-upload/security/advisories/GHSA-hwv5-w8gm-fq9f
• https://nvd.nist.gov/vuln/detail/CVE-2020-15239
• https://github.com/horazont/xmpp-http-upload/pull/12
• https://github.com/horazont/xmpp-http-upload/commit/82056540191e89f0cd697c81f57714c00962ed75
• https://github.com/horazont/xmpp-http-upload
• https://github.com/pypa/advisory-database/tree/main/vulns/xmpp-http-upload/PYSEC-2020-158.yaml
• https://pypi.org/project/xmpp-http-upload/#history

CVE-2020-15239 · published 2020-10-06T18:21:02Z · modified 2026-09-10T03:48:59.588404244Z · JSON