{"action":"Upgrade sanic to 0.5.1 or later.","affected":[{"fixed":"0.5.1","introduced":"0"}],"component":"sanic","cve_ids":["CVE-2017-16762"],"ecosystem":"PyPI","epss":0.02446,"exploited":false,"fixed_versions":["0.5.1"],"ghsa_id":"GHSA-mpmf-hr8p-p49g","id":"tcs_01M5KG79Q4MTGD4XPWC0CNSJX0","modified_at":"2026-06-10T17:02:40.240402639Z","published_at":"2017-11-10T09:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-40","https://github.com/channelcat/sanic/releases/tag/0.5.1","https://github.com/channelcat/sanic/issues/633","https://github.com/advisories/GHSA-mpmf-hr8p-p49g"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-40","url":"https://osv.dev/vulnerability/PYSEC-2017-40"}],"summary":"Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring."}