Junglewise Threat Intelligence

CVE-2022-35920: PYSEC-2026-918 - sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

CVE-2022-35920 · Severity: low · CVSS 3.1 · Published 2026-07-06

Technologies: sanic (PyPI). Vendors: PyPI.

Executive brief

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

Affected products

PyPI sanic

Related threats

PYSEC-2017-40 - Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.