CVEvulnerability
CVE-2023-35844
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-06-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
Description
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
Affected configurations
• lightdash lightdash (< 0.510.3)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://advisory.dw1.io/59 Exploit, Third Party Advisory
- https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c Patch
- https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3 Release Notes
- https://github.com/lightdash/lightdash/pull/5090 Patch
- https://advisory.dw1.io/59 Exploit, Third Party Advisory
- https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c Patch
- https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3 Release Notes
- https://github.com/lightdash/lightdash/pull/5090 Patch