Medium
Security advisory
All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-7647
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:41 UTC · Revision 1
Source evidence
All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.
osv:CVE-2020-7647
Complete source record
{
"id": "31bd076591f9746a6ea0be1845bbd45189a772a9db166592fb9dc349b240e58e",
"url": "https://osv.dev/vulnerability/CVE-2020-7647",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-7647",
"summary": "All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.",
"evidence": "osv:CVE-2020-7647",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-7647",
"aliases": [
"CVE-2020-7647",
"GHSA-px9h-x66r-8mpc"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jooby-project/jooby",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "9939f28218cf4bc686817f4e71d35ceaa4f7a891"
},
{
"introduced": "6599885a736e4ad2962e0f68ae871933735c532e"
},
{
"fixed": "336d17c409a685b6c1c8913137c2844af3fa7bb0"
},
{
"fixed": "34f526028e6cd0652125baa33936ffb6a8a4a009"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jooby:jooby:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.6.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:jooby:jooby:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.8.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "34f526028e6cd0652125baa33936ffb6a8a4a009"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.8.1",
"v2.8.0",
"v2.7.3",
"v2.7.2",
"v2.7.1",
"v2.7.0",
"v2.6.2",
"v2.6.0",
"v2.5.1",
"v2.5.0",
"v2.4.0",
"v1.6.6",
"v1.6.5",
"v2.3.1",
"v2.3.0",
"v2.2.1",
"v1.6.4",
"v2.0.6",
"v2.0.5",
"v2.0.4",
"v2.0.3",
"v1.6.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v1.6.2",
"v1.5.1",
"v1.5.0",
"v1.4.1",
"v1.4.0",
"v1.3.0",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0",
"v1.0.0.CR8",
"v1.0.0.CR7",
"v1.0.0.CR6",
"v1.0.0.CR5",
"v1.0.0.CR4",
"v1.0.0.CR3",
"v1.0.0.CR2",
"v1.0.0.CR1",
"v0.16.0",
"v0.15.1",
"v0.15.0",
"v0.14.0",
"v0.11.2",
"v0.11.1",
"v0.11.0",
"v0.10.0",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.2",
"v0.8.0",
"v0.6.4",
"v0.6.3",
"v0.6.2",
"v0.6.1",
"v0.6.0",
"v0.5.3",
"v0.5.1",
"v0.5.0",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.3.0",
"v0.2.1",
"v0.2.0",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7647.json",
"vanir_signatures": [
{
"id": "CVE-2020-7647-2cce24e8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"212552517428712157371467294294585534240",
"147093936128643861626990937998929825099",
"161455699441314924120019767760285523768",
"225399757400529951307103118832631518208"
]
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/Jooby.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-30c3acbe",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161619109476583297538546584396719559462",
"220039322242277197365860230397327887748",
"23197574679396418500192664508841220059",
"65751704212995262998810260667210623569",
"264603164129503081438426995548196204090",
"329663273969106577944675263073166033549",
"271367844159015131077658879843940319519",
"162455263896057661585712066696501288338",
"64436418796746477026928314336012688988",
"272045558569696631772089029432072281995",
"121739595361313449345920558893233621020",
"26395294751276038574201073044052649795",
"229041600862413423664493720794080674357",
"148836473539862667371261588267637031920",
"306300835907094780300756537667847270203",
"161681231023083642698991046532814073966",
"154801049179100275768052150209375399419",
"13337740928175159383871802720892469121",
"199488054425381468054538460581216835579",
"272542966393869661927810074844494860565",
"50042127032734271336388324578295823012",
"115654318111499550427623890756851905634",
"276408233463882900729839658855231389318",
"308339223633298911252630915387257889266",
"180437011347013350230916310624629527575",
"28895953695910666067238604729251102470",
"218737858211990339887217685854071993855",
"15296571052605611714687845280881085534",
"316720368426529447815056177202755578995",
"278236535212490069415049092537919085430",
"101427733571512144937033309081206587525",
"147285870288971744045186813021497054603",
"40670676738936615326054506128610124224",
"333515045724905617093214801044397208582",
"210082053890601755083962114675563577996",
"232646768052481782671538411414671815158",
"191544610789149892934615371126359611954",
"83539619261385748655790012120573156009",
"227727047672855215105371381322717471285",
"314858372333437310684698453091410413951",
"302678399828485981790394170664615192978",
"69439438098781601605909005642564275576",
"289988596854226553567450107391494496419",
"111594317736714586322150672087582886657",
"329546962189922269897845170613506560139",
"101427733571512144937033309081206587525",
"147285870288971744045186813021497054603",
"40670676738936615326054506128610124224",
"333515045724905617093214801044397208582"
]
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/test/java/org/jooby/handlers/AssetHandlerTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-3fbc3f0f",
"digest": {
"length": 389,
"function_hash": "75241057967001708543721281957661057318"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/handlers/AssetHandler.java",
"function": "loader"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-4090357a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"284322350492569361203734506765649291170",
"136827093381037059458616376707787565962",
"264303008917597091803557587115075696055",
"60391094099022606629608330065167045945",
"61801825286571956707359707498359713253",
"33526670066593473929596474822226528361",
"205403165638214790779260225634952758325",
"193489442842971561582292454855587077646",
"20442799290840717143268826577120657286",
"93986543121478937779861963432483137076",
"305291025028798569154029860022920087669",
"285335777361558924081872405524180021298",
"78342945295682891454935020018671613060",
"223419838728779314055983705709925705980",
"324551429510142990401124741168193164829",
"278320749890395878115291678375008741950",
"205183241704002128945135423206533714404",
"59052504140460411738338378794719648349",
"289065534069548466962947460895581151534",
"183611433890964603668251361930555441292",
"311308161950726684996214519692419857381",
"187298452861405541684825886488057519378",
"279281705128073278619715575461867803478",
"305395475114309386361540186419582807776",
"74012423974450463777487136179838645657",
"159171285040264884613342277930255316955",
"77660057087804913031363862899427491295",
"788229357149381105200211785686573652",
"179480269685709459926430911818804209249",
"126876795071536668615007228950638352250",
"50427289188281236132518963613984548263",
"214550049168712985641314749541024311605",
"247634509453895134292997914189489175492",
"255148454907132289276295066772800706345",
"148382419024157856204569456260564274626",
"288005860740605738608869021571912389044",
"619578806602993429146164857448611813",
"278896089546321282352813780308131577181",
"92068565714551165840960895930518440685",
"5725240016021211540320050202163470958",
"204660894949651229210459101273848472453",
"154483012249047875615819488984073941922",
"169143056989761286289151985313700935246",
"203194016462557195739070119297283820310",
"82828110035805884975016328122102661148"
]
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/handlers/AssetHandler.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-501d60fa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52148661555948863435409834028586203781",
"184588606516991175512448254941564428088",
"263012345203460402638656135733543809824",
"169156186728749097061692794176810427175"
]
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/Route.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-63b39f70",
"digest": {
"length": 94,
"function_hash": "254581573106088760683469565324234339652"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/handlers/AssetHandler.java",
"function": "AssetHandler"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-81a91246",
"digest": {
"threshold": 0.9,
"line_hashes": [
"331662337386970174962454510193855227212",
"134031160254590619306537787746623124145",
"169123550308704033040542670929144006853",
"106566741536656472393723582151532260825"
]
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "modules/jooby-assets/src/main/java/org/jooby/assets/Assets.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-8d26ad11",
"digest": {
"length": 519,
"function_hash": "196924709567893721070102555563098996456"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/test/java/org/jooby/handlers/AssetHandlerTest.java",
"function": "shouldCallParentOnMissing"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-a7a9a41e",
"digest": {
"length": 138,
"function_hash": "131057297732683348926529263260131709388"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/handlers/AssetHandler.java",
"function": "AssetHandler"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-c0829416",
"digest": {
"length": 669,
"function_hash": "218380327951740662995268275220733732761"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/test/java/org/jooby/handlers/AssetHandlerTest.java",
"function": "ignoreMalformedURL"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-dfeb46d1",
"digest": {
"length": 130,
"function_hash": "221043030479498978702136822320930078165"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/Route.java",
"function": "AssetDefinition"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-ed73fd86",
"digest": {
"length": 365,
"function_hash": "27204629277782650604377669985330048389"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/test/java/org/jooby/handlers/AssetHandlerTest.java",
"function": "customClassloader"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-efdb4000",
"digest": {
"length": 363,
"function_hash": "253752291365241395640510288289306821889"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/handlers/AssetHandler.java",
"function": "init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7647-f693b473",
"digest": {
"length": 136,
"function_hash": "292608528522259998917157987719629665065"
},
"source": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009",
"target": {
"file": "jooby/src/main/java/org/jooby/handlers/AssetHandler.java",
"function": "AssetHandler"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:14:02Z"
}
}
],
"modified": "2026-10-20T14:14:02.044711556Z",
"provider": "osv",
"references": [
"https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806%2C",
"https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807%2C",
"https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-7647",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388736,
"published_at": "2020-05-11T20:15:12.463+00:00"
}