CVE-2022-35920: Sanic Project Sanic

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.

Affected products

• Sanic Project Sanic: before 20.12.7 (fixed in 20.12.7); from 21.0.0, before 21.12.2 (fixed in 21.12.2); from 22.0.0, before 22.6.1 (fixed in 22.6.1)

Published 2022-08-01. Last modified 2026-06-17.