Read the docs
TI-2021-06053 Aliases CVE-2021-23357GHSA-3qx7-r2pf-8cwr

Directory traversal in github.com/TykTechnologies/tyk/gateway

Priority LOW 25CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this value is then used to create a file on disk. If there is a file found with the same name then it will be deleted and then re-created with the contents of the API creation request.

Why it matters now

EPSS 0.00525 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/TykTechnologies/tyk/gatewayall versions—No fix listedCNA
  • github.com/TykTechnologies/tyk/gateway Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tyk:tyk:*:*:*:*:*:*:*:*all versionsVulnerableTyk
  • cpe:2.3:a:tyk:tyk:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Tyk

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23357
  2. 2026-10-03 Alias added: GHSA-3qx7-r2pf-8cwr

References

Exploit 1

  • TI-2023-22554 Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker… CVSS 3.1CRITICAL 9.8
  • TI-2023-22553 Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences