{"action":"Upgrade github.com/treeverse/lakefs to 1.12.1 or later.","affected":[{"fixed":"1.12.1","introduced":"0.90.0"}],"component":"github.com/treeverse/lakefs","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["1.12.1"],"ghsa_id":"GHSA-fvv5-h29g-f6w5","id":"tcs_01M5KF9VGCPTHKY3XPEY319WQJ","modified_at":"2024-06-04T16:56:54.526779Z","published_at":"2024-02-22T21:36:04Z","references":["https://osv.dev/vulnerability/GHSA-fvv5-h29g-f6w5","https://github.com/treeverse/lakeFS/security/advisories/GHSA-fvv5-h29g-f6w5","https://github.com/treeverse/lakeFS/commit/56556ee5406fc5425b9302cd08a8d412635fdcd7","https://github.com/treeverse/lakeFS"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-fvv5-h29g-f6w5","url":"https://osv.dev/vulnerability/GHSA-fvv5-h29g-f6w5"}],"summary":"User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository"}