VYPR
Moderate severityNVD Advisory· Published Jul 20, 2020· Updated Aug 4, 2024

CRLF vulnerability in Fiber

CVE-2020-15111

Description

In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment().

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/gofiber/fiberGo
< 1.12.61.12.6

Affected products

1

Patches

1
f698b5d5066c

🐛 Escape fname

https://github.com/gofiber/fiberFennyJul 10, 2020via ghsa
1 file changed · +1 1
  • ctx.go+1 1 modified
    @@ -196,7 +196,7 @@ func (ctx *Ctx) Attachment(filename ...string) {
     	if len(filename) > 0 {
     		fname := filepath.Base(filename[0])
     		ctx.Type(filepath.Ext(fname))
    -		ctx.Set(HeaderContentDisposition, `attachment; filename="`+fname+`"`)
    +		ctx.Set(HeaderContentDisposition, `attachment; filename="`+url.QueryEscape(fname)+`"`)
     		return
     	}
     	ctx.Set(HeaderContentDisposition, "attachment")
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.