CVE-2021-23357

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this value is then used to create a file on disk. If there is a file found with the same name then it will be deleted and then re-created with the contents of the API creation request.

• CWE-22

• https://github.com/TykTechnologies/tyk/issues/3390Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKGATEWAY-1078516Third Party Advisory
• https://github.com/TykTechnologies/tyk/issues/3390Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKGATEWAY-1078516Third Party Advisory

Published

Mar 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23351The package github.com/pires/go-proxyproto before 0.5.0 are …4.9
• CVE-2021-23352This affects the package madge before 4.0.1. It is possible …9.8
• CVE-2021-23353This affects the package jspdf before 2.3.1. ReDoS is possib…7.5
• CVE-2021-23354The package printf before 0.6.1 are vulnerable to Regular Ex…7.5
• CVE-2021-23355This affects all versions of package ps-kill. If (attacker-c…9.8
• CVE-2021-23356This affects all versions of package kill-process-by-name. I…9.8
• CVE-2021-23358The package underscore from 1.13.0-0 and before 1.13.0-2, fr…7.2
• CVE-2021-23359This affects all versions of package port-killer. If (attack…8.8
• CVE-2021-2336Vulnerability in the Oracle Database - Enterprise Edition Da…3.5
• CVE-2021-23360This affects the package killport before 1.0.2. If (attacker…8.8
• CVE-2021-23361Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-23362The package hosted-git-info before 3.0.8 are vulnerable to R…5.3