PyPI/shiva CVE-2022-31558: critical 9.3, EPSS 1.28%
Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.10.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-541
- https://nvd.nist.gov/vuln/detail/CVE-2022-31558
- https://github.com/tooxie/shiva-server/issues/189
- https://github.com/tooxie/shiva-server
- https://pypi.org/project/shiva
- https://github.com/advisories/GHSA-qp72-96p2-g644
CVE-2022-31558 · published · modified · JSON