CVE-2022-31558: 
Python vulnerability analysis and mitigation

The tooxie/shiva-server repository through 0.10.0 on GitHub contains a path traversal vulnerability (CVE-2022-31558) that allows absolute path traversal due to unsafe usage of the Flask send_file function. The vulnerability was discovered and disclosed in July 2022 (NVD).

The vulnerability is classified as a path traversal issue (CWE-22) where the application fails to properly restrict pathname access to a restricted directory. The CVSS v3.1 base score is 9.3 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating that it is network exploitable with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability allows attackers to access files outside of the intended directory structure through absolute path traversal, potentially exposing sensitive system files and information (NVD).

The vulnerability is exploitable remotely with low attack complexity. No authentication is required to exploit this vulnerability, making it particularly dangerous (NVD).

Users should upgrade to a version newer than 0.10.0 if available. If upgrading is not possible, implementing proper input validation and path sanitization for the Flask send_file function is recommended (NVD).