{"action":"Upgrade github.com/cloudflare/cfrpki to 1.4.4 or later.","affected":[{"fixed":"1.4.4","introduced":"0"}],"component":"github.com/cloudflare/cfrpki","cve_ids":["CVE-2021-3907"],"ecosystem":"Go","epss":0.04199,"exploited":false,"fixed_versions":["1.4.4"],"ghsa_id":"GHSA-8459-6rc9-8vf8","id":"tcs_01M5KFTXFBJ46P7PDRFM3Q84ZG","modified_at":"2026-02-04T03:00:30.292123Z","published_at":"2022-07-15T23:07:18Z","references":["https://osv.dev/vulnerability/GO-2022-0248","https://github.com/cloudflare/cfrpki/commit/eb9cc4db7b7b79e44f56dfaa959fccdfb2af8284","https://github.com/cloudflare/cfrpki/commit/a053a808feeb3115c76b6cc263ee55598ce6e8cd"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2022-0248","url":"https://osv.dev/vulnerability/GO-2022-0248"}],"summary":"Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki"}