NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/nats-io/nats-server/v2(Go) | 2.2.0 | 2.7.4 | N/A |
| github.com/nats-io/nats-streaming-server(Go) | 0.15.0 | 0.24.3 | N/A |
CVSS Metrics
