Skip to main content
cve.nowby Sazabi
← Go
GoPackage

go.senan.xyz/gonic

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 3 high
Registry
pkg.go.dev

Advisories 3

  • gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the…

    Affected: fixed in 0.21.0.

  • Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

    Affected: fixed in 0.21.0.

  • Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist

    Affected: fixed in 0.21.0.