CVE-2020-15111

In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment().

• CWE-74
• CWE-93
• CWE-74

• https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56fPatch, Third Party Advisory
• https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvhThird Party Advisory
• https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56fPatch, Third Party Advisory
• https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvhThird Party Advisory

Published

Jul 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15106In etcd before versions 3.3.23 and 3.4.10, a large slice cau…6.5
• CVE-2020-15107In openenclave before 0.10.0, enclaves that use x87 FPU oper…5.3
• CVE-2020-15108In glpi before 9.5.1, there is a SQL injection for all usage…7.1
• CVE-2020-15109In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there i…5.3
• CVE-2020-1511An elevation of privilege vulnerability exists when Connecte…7.8
• CVE-2020-15110In jupyterhub-kubespawner before 0.12, certain usernames wil…8.1
• CVE-2020-15112In etcd before versions 3.3.23 and 3.4.10, it is possible to…6.5
• CVE-2020-15113In etcd before versions 3.3.23 and 3.4.10, certain directory…7.1
• CVE-2020-15114In etcd before versions 3.3.23 and 3.4.10, the etcd gateway …7.7
• CVE-2020-15115etcd before versions 3.3.23 and 3.4.10 does not perform any …7.5
• CVE-2020-15117In Synergy before version 1.12.0, a Synergy server can be cr…6.5
• CVE-2020-15118In Wagtail before versions 2.7.4 and 2.9.3, when a form page…5.4