How severe is CVE-2023-29401?

CVE-2023-29401 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2023-29401 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-29401?

CVE-2023-29401 affects Gin-gonic Gin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-29401?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-29401 published?

CVE-2023-29401 was published on 2023-06-08 and last updated on 2026-06-17.

CVE-2023-29401

CVE-2023-29401 is a medium-severity vulnerability in Gin-gonic Gin with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-494.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (38th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-494
Affected product: Gin-gonic Gin
Published: 2023-06-08
Last modified: 2026-06-17

Description

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

Frequently asked questions

What is CVE-2023-29401?: The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
How severe is CVE-2023-29401?: CVE-2023-29401 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2023-29401 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-29401?: CVE-2023-29401 affects Gin-gonic Gin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-29401?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-29401 published?: CVE-2023-29401 was published on 2023-06-08 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:gin-gonic:gin:*:*:*:*:*:*:*:*

More vulnerabilities in Gin-gonic Gin

CVE-2020-36567 — High (CVSS 7.5): Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject…
CVE-2020-28483 — High (CVSS 7.1): This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's…
CVE-2023-26125 — Medium (CVSS 5.6): Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing…

All CVEs affecting Gin-gonic Gin →

Other CWE-494 vulnerabilities

CVE-2020-1595 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from…
CVE-2020-1210 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source…
CVE-2026-42248 — Critical (CVSS 9.8): Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike…
CVE-2026-34841 — Critical (CVSS 9.8): Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack…
CVE-2026-3000 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…
CVE-2026-2999 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…

Browse all CWE-494 vulnerabilities →