PyPI: solara
CVE-2024-39903
Safety vulnerability ID: SFTY-20240712-95439
Safety legacy ID: pyup.io-72181
A Local File Inclusion (LFI) vulnerability affects widgetti/solara. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
Overview
Local File Inclusion in Solara
Advisory
A Local File Inclusion (LFI) vulnerability affects widgetti/solara. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240712-95439/CVE-2024-39903
- https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w
- https://nvd.nist.gov/vuln/detail/CVE-2024-39903
- https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54
- https://github.com/advisories/GHSA-9794-pc4r-438w
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more