Code Security Finding: Path/Directory Traversal (CWE-22, High Severity) in MailHeaderInjectionServlet.java:138

[joshn-whitesource-app]

Code Security Finding

This finding was first detected on 2024-02-16 01:29pm GMT and is still present in the last scan performed on 2024-02-16 01:58pm GMT:

Severity	Vulnerability Type	CWE	File	Data Flows
High	Path/Directory Traversal	CWE-22	MailHeaderInjectionServlet.java:138	1
Vulnerable Code easybuggy4/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java Lines 133 to 138 in f83166e File saveFile = new File(fileName); log.debug("Uploaded file is saved on: " + saveFile.getAbsolutePath()); FileOutputStream outputStream = null; InputStream inputStream = null; try { outputStream = new FileOutputStream(saveFile); 1 Data Flow/s detected Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet 🏴 Suppress Finding ... as False Alarm ... as Acceptable Risk