CVE-2019-25073: Path Traversal in github.com/goadesign/goa
Summary
CVE-2019-25073: Path traversal in github.com/goadesign/goa. Affects github.com/goadesign/goa versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/goadesign/goa is a Go package that provides a framework for building microservices and APIs. It includes features such as request routing, middleware, and error handling. The vulnerability in this package allows for path traversal, which means that an attacker can access files outside of the intended directory that the server has permission to read.
Vulnerability Detail
The vulnerability arises due to improper sanitization of user input in the Controller.FileHandler function. By exploiting this vulnerability, an attacker can manipulate the input to traverse directories and read sensitive files on the server. This can lead to unauthorized access to confidential information, such as configuration files or user data. The vulnerability affects versions 0 to 1.4.2 of the github.com/goadesign/goa package.
How To Fix
Latest published version: v2.2.5+incompatible as of 22 Oct 2026
go get github.com/goadesign/goa@v2.2.5+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.3
This is the first release that contains the fix.
go get github.com/goadesign/goa@v1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to implement additional input validation and sanitization in the affected code. This can involve checking user input for any directory traversal characters and rejecting or properly handling such input. However, it is strongly recommended to update to the fixed version of the package as soon as possible.
Conclusion
The path traversal vulnerability in github.com/goadesign/goa can allow attackers to access sensitive files on the server. It is crucial to update to version 1.4.3 or later of the package to fix this vulnerability. If immediate update is not possible, implementing additional input validation and sanitization can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/goadesign/goa →
FAQ
Path traversal, also known as directory traversal, is a vulnerability that allows an attacker to access files and directories outside of the intended scope. It occurs when user input is not properly validated or sanitized, allowing malicious input to manipulate file paths and access sensitive information.
The path traversal vulnerability in github.com/goadesign/goa can lead to unauthorized access to sensitive files on the server. This can expose confidential information, such as database credentials, configuration files, or user data. Attackers can exploit this vulnerability to gather information for further attacks or to gain unauthorized privileges.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities in your software.
Yes, the vulnerability has been fixed in version 1.4.3 of the github.com/goadesign/goa package. It is recommended to update to this version or later to mitigate the vulnerability.
If updating the package is not immediately feasible, you can implement additional input validation and sanitization in the affected code to mitigate the vulnerability. However, it is strongly recommended to update to the fixed version of the package as soon as possible.
