# CVE-2022-35920: PYSEC-2026-918 - sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

Source: https://junglewise.ai/threats/cve-2022-35920-sanic-vulnerable-to-path-traversal-when-using-app-static-if-using  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2022-35920 · Severity: low · CVSS 3.1 · Published 2026-07-06

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

Technologies: [sanic (PyPI)](https://junglewise.ai/threats/technologies/sanic). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-35920 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-35920 being exploited in the wild.

**How severe is CVE-2022-35920?** Low severity, with a CVSS score of 3.1, published 6 July 2026.

**Which products and versions are affected?** sanic (PyPI) ECOSYSTEM:introduced=0,fixed=20.12.7,introduced=22.0.0,fixed=22.6.1,introduced=21.0.0,fixed=21.12.2, ECOSYSTEM:introduced=22.0.0,fixed=22.6.1.

**Is there a fix for CVE-2022-35920?** Yes. sanic (PyPI): upgrade to 21.12.2, 22.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-35920?** Check whether you run sanic (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sanic (PyPI): upgrade to 21.12.2, 22.6.1 or later

  ```sh
  pip install "sanic>=22.6.1"
  ```


## Affected products

- sanic (PyPI) ECOSYSTEM:introduced=0,fixed=20.12.7,introduced=22.0.0,fixed=22.6.1,introduced=21.0.0,fixed=21.12.2, ECOSYSTEM:introduced=22.0.0,fixed=22.6.1

## Identifiers

- CVE-2022-35920
- GHSA-8cw9-5hmv-77w6
- PYSEC-2026-918

## Related threats

- [Sanic HTTP chunked trailer request smuggling](https://junglewise.ai/threats/cve-2026-85078-sanic-http-chunked-trailer-request-smuggling)
- [Server crash if running Python 3.10 w/ Sanic 20.12](https://junglewise.ai/threats/server-crash-if-running-python-3-10-w-sanic-20-12-e0de2ea0)
- [PYSEC-2017-40 - Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.](https://junglewise.ai/threats/cve-2017-16762-sanic-arbitrary-file-read-and-directory-traversal)