---
id: CVE-2022-35920
aliases:
  - GHSA-8cw9-5hmv-77w6
  - PYSEC-2026-918
title: >-
  sanic vulnerable to Path Traversal when using `app.static` if using encoded
  `%2F` URLs
summary: >-
  sanic vulnerable to Path Traversal when using `app.static` if using encoded
  `%2F` URLs
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L'
vendor: sanic
product: sanic
ecosystem: pip
affected:
  - 'sanic >= 22.0.0, < 22.6.1'
  - 'sanic >= 21.0.0, < 21.12.2'
  - sanic < 20.12.7
patched:
  - sanic 22.6.1
  - sanic 21.12.2
  - sanic 20.12.7
published: '2022-08-06'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8cw9-5hmv-77w6'
references:
  - url: 'https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-35920'
  - url: 'https://github.com/sanic-org/sanic/issues/2478'
  - url: 'https://github.com/sanic-org/sanic/pull/2495'
  - url: 'https://github.com/sanic-org/sanic'
tags:
  - osv
  - pip
epss: 0.0114
epssPercentile: 0.65237
ingestedAt: '2026-07-08T18:25:47.459Z'
---

## Overview

### Impact
Access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted.

### Patches
- v20.12.7 (LTS)
- v21.12.2 (LTS)
- v22.6.1

### References
https://github.com/sanic-org/sanic/issues/2478
https://github.com/sanic-org/sanic/pull/2495

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the community forums](https://community.sanicframework.org/)
* Ping us on [the Discord server](https://discord.gg/FARQzAEMAA)



## Affected packages

- `sanic >= 22.0.0, < 22.6.1`
- `sanic >= 21.0.0, < 21.12.2`
- `sanic < 20.12.7`

## Remediation

Upgrade to a patched release:

- `sanic 22.6.1`
- `sanic 21.12.2`
- `sanic 20.12.7`