{"action":"Upgrade github.com/gin-gonic/gin to 1.9.1 or later.","affected":[{"fixed":"1.9.1","introduced":"1.3.1-0.20190301021747-ccb9e902956d"}],"component":"github.com/gin-gonic/gin","cve_ids":["CVE-2023-29401"],"ecosystem":"Go","epss":0.00482,"exploited":false,"fixed_versions":["1.9.1"],"ghsa_id":"GHSA-2c4m-59x9-fr2g","id":"tcs_01M5KERXZW1BFHE1RNPGSBH785","modified_at":"2023-11-08T04:12:18.674169Z","published_at":"2023-05-12T20:19:25Z","references":["https://osv.dev/vulnerability/GHSA-2c4m-59x9-fr2g","https://nvd.nist.gov/vuln/detail/CVE-2023-29401","https://github.com/gin-gonic/gin/issues/3555","https://github.com/gin-gonic/gin/pull/3556","https://github.com/gin-gonic/gin","https://github.com/gin-gonic/gin/releases/tag/v1.9.1","https://pkg.go.dev/vuln/GO-2023-1737"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-2c4m-59x9-fr2g","url":"https://osv.dev/vulnerability/GHSA-2c4m-59x9-fr2g"}],"summary":"Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function"}