CVE-2020-25032: Debian Linux

High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days.

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

Affected products

• Debian Debian Linux: version 10.0 only
• Flask-Cors Project Flask-Cors: before 3.0.9 (fixed in 3.0.9)
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only; version 15.2 only

Published 2020-08-31. Last modified 2026-06-17.