{"action":"Upgrade sinatra to 2.2.3 or later.","affected":[{"fixed":"3.0.4","introduced":"3.0"},{"fixed":"2.2.3","introduced":"2.0.0"}],"component":"sinatra","cve_ids":["CVE-2022-45442"],"ecosystem":"RubyGems","epss":0.00691,"exploited":false,"fixed_versions":["3.0.4","2.2.3"],"ghsa_id":"GHSA-2x8x-jmrp-phxw","id":"tcs_01M5KEG26DWPVCZWP864EV1G28","modified_at":"2026-02-04T02:35:49.068446Z","published_at":"2022-11-30T21:18:34Z","references":["https://osv.dev/vulnerability/GHSA-2x8x-jmrp-phxw","https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw","https://nvd.nist.gov/vuln/detail/CVE-2022-45442","https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b","https://github.com/advisories/GHSA-8x94-hmjh-97hq","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2022-45442.yml","https://github.com/sinatra/sinatra","https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html","https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-2x8x-jmrp-phxw","url":"https://osv.dev/vulnerability/GHSA-2x8x-jmrp-phxw"}],"summary":"Sinatra vulnerable to Reflected File Download attack"}