External Control of File Name or Path Affecting voila package, versions [0.0.2,0.2.17) [0.3.0a0,0.3.8) [0.4.0a0,0.4.4) [0.5.0a0,0.5.6)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-VOILA-6531301
- published 4 Apr 2024
- disclosed 3 Apr 2024
- credit ericfinger
Introduced: 3 Apr 2024
CVE-2024-30265 Open this link in a new tabHow to fix?
Upgrade voila to version 0.2.17, 0.3.8, 0.4.4, 0.5.6 or higher.
Overview
voila is a Voilà turns Jupyter notebooks into standalone web applications
Affected versions of this package are vulnerable to External Control of File Name or Path due to improper handling of the static_path configuration. An attacker can achieve local file inclusion by making a crafted request to the server, exploiting the misconfiguration to download any file readable by the server's running user.
Note
This vulnerability is contingent upon the server's deployment configuration, as authentication requirements may vary.