CVE-2020-15230— Arbitrary file read un Vapor
Quick assessment
Affected
vapor vapor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
vapor是个人开发者的一个 Swift 的 Web 开发框架。可用于开发高性能的Web应用，支持 iOS、OS X 和 Ubuntu 系统。 Vapor 4.29.4版本存在安全漏洞，攻击者可利用该漏洞可以访问数据在任意文件系统路径在同一个主机上作为一个应用程序。只有应用程序使用FileMiddleware都受到影响。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-15230
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arbitrary file read un Vapor
Source: CVE Program / CVE List V5
Vulnerability Description
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
vapor 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
vapor是个人开发者的一个 Swift 的 Web 开发框架。可用于开发高性能的Web应用，支持 iOS、OS X 和 Ubuntu 系统。 Vapor 4.29.4版本存在安全漏洞，攻击者可利用该漏洞可以访问数据在任意文件系统路径在同一个主机上作为一个应用程序。只有应用程序使用FileMiddleware都受到影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2020-15230
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15230
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-15230 (2)
-
https://github.com/vapor/vapor/pull/2500 x_refsource_MISC
Vendor Advisories for CVE-2020-15230 (1)
-
https://github.com/vapor/vapor/security/advisories/GHSA-vcvg-xgr8-p5gq x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: vapor
-
CVE-2024-21631
Integer overflow in URI leading to potential host spoofing -
CVE-2023-44386
Incorrect request error handling triggers server crash in Va -
CVE-2022-31019
DoS Vulnerability in URLEncodedFormDecoder in Vapor -
CVE-2022-31005
Integer Overflow in Vapor's HTTP Range Request -
CVE-2021-32742
Untrusted data fed into `Data.init(base32Encoded:)` can resu
Same vendor: vapor
-
CVE-2026-28499
LeafKit's HTML escaping may be skipped for Collection values -
CVE-2026-27120
Leaf-kit html escaping does not work on characters that are -
CVE-2024-21631
Integer overflow in URI leading to potential host spoofing -
CVE-2023-44386
Incorrect request error handling triggers server crash in Va -
CVE-2023-31136
PostgresNIO processes unencrypted bytes from man-in-the-midd
Same weakness: CWE-22
-
CVE-2026-77139
Path Traversal in extension "Mask" (mask) -
CVE-2026-68062
SKYSEA Client View路径遍历漏洞 -
CVE-2026-78638
peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js u -
CVE-2026-78677
GitPython before 3.1.59 Path Traversal via separate-git-dir -
CVE-2026-72697
Grav CMS before 2.0.16 Path Traversal via media_directory
V. Comments for CVE-2020-15230
No comments yet