External Control of File Name or Path Affecting mistral-dashboard package, versions [,14.0.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-MISTRALDASHBOARD-14135980
- published27 Nov 2025
- disclosed26 Nov 2025
- creditUnknown
Introduced: 26 Nov 2025
NewCVE-2021-4472 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade mistral-dashboard to version 14.0.1 or higher.
Overview
mistral-dashboard is a Mistral dashboard
Affected versions of this package are vulnerable to External Control of File Name or Path through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content. An attacker can access arbitrary local files by leveraging this process to include files from the local filesystem.