{"action":"Upgrade github.com/treeverse/lakefs to 1.12.1 or later.","affected":[{"fixed":"1.12.1","introduced":"0.90.0"}],"component":"github.com/treeverse/lakefs","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["1.12.1"],"ghsa_id":"GHSA-fvv5-h29g-f6w5","id":"tcs_01M5KG1J4M4X8Y2MBK4XWDE5FN","modified_at":"2026-03-03T04:54:48.953243Z","published_at":"2024-06-04T15:19:21Z","references":["https://osv.dev/vulnerability/GO-2024-2581","https://github.com/treeverse/lakeFS/security/advisories/GHSA-fvv5-h29g-f6w5","https://github.com/treeverse/lakeFS/commit/56556ee5406fc5425b9302cd08a8d412635fdcd7"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-2581","url":"https://osv.dev/vulnerability/GO-2024-2581"}],"summary":"User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs"}