TI-2020-06168 Aliases CVE-2020-7647 GHSA-px9h-x66r-8mpc

Path traversal in io.jooby:jooby and org.jooby:jooby

LOW 27CWE-22Published 2020-05-11 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.

Why it matters now

EPSS 0.01554 75th percentileScored 2026-11-07

Fix Fixed io.jooby:jooby (Maven): 2.8.2org.jooby:jooby (Maven): 2.8.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	io.jooby:jooby and org.jooby:jooby	all versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2	—	No fix listed	CNA
—	io.jooby:jooby (Maven)	before 2.8.2	2.8.2	Patch available	GHSA-px9h-x66r-8mpc
—	org.jooby:jooby (Maven)	before 2.8.2	2.8.2	Patch available	GHSA-px9h-x66r-8mpc

io.jooby:jooby and org.jooby:jooby Vendor— Affected all versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 Fixed in — No fix listed CNA
io.jooby:jooby (Maven) Vendor— Affected before 2.8.2 Fixed in 2.8.2 Patch available GHSA-px9h-x66r-8mpc
org.jooby:jooby (Maven) Vendor— Affected before 2.8.2 Fixed in 2.8.2 Patch available GHSA-px9h-x66r-8mpc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jooby:jooby::::::::	before 1.6.7; 2.0.0 to before 2.8.2	Vulnerable	Jooby

cpe:2.3:a:jooby:jooby:*:*:*:*:*:*:*:* Versions before 1.6.7; 2.0.0 to before 2.8.2 Vulnerable ·Jooby

Remediation

Fix · GHSA-px9h-x66r-8mpc io.jooby:jooby (Maven) Fixed in 2.8.2 Advisory →
Fix · GHSA-px9h-x66r-8mpc org.jooby:jooby (Maven) Fixed in 2.8.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-7647
2026-10-03 Alias added: GHSA-px9h-x66r-8mpc

References

Patch 1

https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2020-7647

Other 2

TI-2020-06143 HTTP response splitting in io.jooby:jooby-netty CVSS 3.1CRITICAL 9.8
TI-2019-11581 Jooby before 1.6.4 has XSS via the default error handler. CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences