Arbitrary file write in github.com/kataras/iris
Priority MEDIUM 42CWE-59Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Why it matters now
EPSS 0.01882 79th percentileScored 2026-11-07
Fix Fixed github.com/kataras/iris/v12 (Go): 12.2.0-alpha8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/kataras/iris | all versions | — | No fix listed | CNA |
| — | github.com/kataras/iris/v12 | all versions | — | No fix listed | CNA |
| — | github.com/kataras/iris/v12 (Go) | before 12.2.0-alpha8 | 12.2.0-alpha8 | Patch available | GHSA-jcxc-rh6w-wf49 |
| — | github.com/kataras/iris (Go) | up to 0.0.2 | — | No fix listed | GHSA-jcxc-rh6w-wf49 |
- github.com/kataras/iris Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/kataras/iris/v12 Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/kataras/iris/v12 (Go) Vendor— Affected before 12.2.0-alpha8 Fixed in 12.2.0-alpha8 Patch available GHSA-jcxc-rh6w-wf49
- github.com/kataras/iris (Go) Vendor— Affected up to 0.0.2 Fixed in — No fix listed GHSA-jcxc-rh6w-wf49
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:iris-go:iris:*:*:*:*:*:go:*:* | up to 12.1.8 | Vulnerable | Iris-go |
| cpe:2.3:a:iris-go:iris:12.2.0:alpha:*:*:*:go:*:* | 12.2.0 alpha | Vulnerable | Iris-go |
| cpe:2.3:a:iris-go:iris:12.2.0:alpha2:*:*:*:go:*:* | 12.2.0 alpha2 | Vulnerable | Iris-go |
| cpe:2.3:a:iris-go:iris:12.2.0:alpha3:*:*:*:go:*:* | 12.2.0 alpha3 | Vulnerable | Iris-go |
| cpe:2.3:a:iris-go:iris:12.2.0:alpha4:*:*:*:go:*:* | 12.2.0 alpha4 | Vulnerable | Iris-go |
| cpe:2.3:a:iris-go:iris:12.2.0:alpha5:*:*:*:go:*:* | 12.2.0 alpha5 | Vulnerable | Iris-go |
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.7.5 | Running on | Go standard library |
- cpe:2.3:a:iris-go:iris:*:*:*:*:*:go:*:* Versions up to 12.1.8 Vulnerable ·Iris-go
- cpe:2.3:a:iris-go:iris:12.2.0:alpha:*:*:*:go:*:* Versions 12.2.0 alpha Vulnerable ·Iris-go
- cpe:2.3:a:iris-go:iris:12.2.0:alpha2:*:*:*:go:*:* Versions 12.2.0 alpha2 Vulnerable ·Iris-go
- cpe:2.3:a:iris-go:iris:12.2.0:alpha3:*:*:*:go:*:* Versions 12.2.0 alpha3 Vulnerable ·Iris-go
- cpe:2.3:a:iris-go:iris:12.2.0:alpha4:*:*:*:go:*:* Versions 12.2.0 alpha4 Vulnerable ·Iris-go
- cpe:2.3:a:iris-go:iris:12.2.0:alpha5:*:*:*:go:*:* Versions 12.2.0 alpha5 Vulnerable ·Iris-go
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.7.5 Running on ·Go standard library
Remediation
- Fix · GHSA-jcxc-rh6w-wf49 github.com/kataras/iris/v12 (Go) Fixed in 12.2.0-alpha8 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Advanced Cluster Management for Kubernetes 2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23772
- 2026-10-03 Alias added: GHSA-jcxc-rh6w-wf49
References
Sources
- CVE-2021-23772 · CVE Program
- CVE-2021-23772 · NVD
- FIRST EPSS
- GHSA-jcxc-rh6w-wf49 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23772 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences