Broken Path Sanitization in spacecookie Library

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0004.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0004.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "spacecookie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.0.0"
            },
            {
              "fixed": "1.0.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# Broken Path Sanitization in spacecookie Library\n\nThe spacecookie library exposes the functions `sanitizePath` and `sanitizeIfNotUrl` intended to\nremove `..` components from paths which can be used to prevent path traversal attacks. Due to\nerroneous comparison code, this elimination is not actually performed which has been remedied\nin version 1.0.0.3 by properly comparing using `equalFilePath`.\n\nAny user of those respective functions of any version of spacecookie should upgrade to 1.0.0.3\nor later. Note that the spacecookie server executable included in the same package is not affected\nby the problem since a separate check would reject any malicious path that gets by `sanitizePath`.\n",
  "id": "HSEC-2025-0004",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/sternenseemann/spacecookie/commit/2854a8a70833e7abdeeff3c02596a6f2a2f35c61"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Broken Path Sanitization in spacecookie Library"
}