CVE-2019-25073: Path Traversal Vulnerability in github.com/goadesign/goa
Summary
CVE-2019-25073: Goa vulnerable to path traversal. Affects github.com/goadesign/goa versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/goadesign/goa is a Go package that provides a framework for building microservices and APIs. It offers a set of tools and utilities to simplify the development process. However, versions before v3.0.9, v2.0.10, or v1.4.3 of goa are vulnerable to a path traversal attack.
Vulnerability Detail
The path traversal vulnerability in goa allows remote attackers to read files outside of the intended directory. This occurs due to improper path sanitization. An attacker can exploit this vulnerability to access sensitive files and potentially gain unauthorized access to the system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: v2.2.5+incompatible as of 22 Oct 2026
go get github.com/goadesign/goa@v2.2.5+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.3
This is the first release that contains the fix.
go get github.com/goadesign/goa@v1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions mentioned above.
Conclusion
The path traversal vulnerability in github.com/goadesign/goa can lead to unauthorized access to sensitive files. It is crucial to update to the fixed versions (v3.0.9, v2.0.10, or v1.4.3) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/goadesign/goa →
FAQ
This vulnerability allows remote attackers to read files outside of the intended directory, potentially exposing sensitive information and compromising the system's security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground, and it will alert you in real-time if your application is vulnerable.
Yes, all versions of goa before v3.0.9, v2.0.10, or v1.4.3 are vulnerable to this path traversal attack. It is crucial to update to the fixed versions to mitigate the risk.
There is no known public exploit for this vulnerability at the time of this advisory. However, it is recommended to update to the fixed versions as soon as possible to prevent any potential exploitation.
You can find more information about this vulnerability, including the technical details and the fix, in the advisory on the GitHub Advisory Database: [link to advisory]
