Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-35918— Streamlit directory traversal vulnerability

Quick assessment

Affected
streamlit streamlit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Streamlit是Streamlit开源的一个面向数据的 Python 应用程序开发框架。 Streamlit 1.11.1之前版本存在路径遍历漏洞，该漏洞源于是一个面向数据的python应用开发框架，使用自定义组件托管Streamlit应用程序的用户容易受到目录遍历攻击，这可能会泄露他们网络服务器文件系统中的数据，如：服务器日志、全局可读文件以及潜在的其他敏感信息。攻击者可以制作一个带有文件路径的恶意URL，streamlit服务器将处理该URL并返回该文件的内容或覆盖Web服务器上的现有文件。这个问

CVSS 6.5 · Medium EPSS 1.72% · P77
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-35918

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Streamlit directory traversal vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Streamlit 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Streamlit是Streamlit开源的一个面向数据的 Python 应用程序开发框架。 Streamlit 1.11.1之前版本存在路径遍历漏洞，该漏洞源于是一个面向数据的python应用开发框架，使用自定义组件托管Streamlit应用程序的用户容易受到目录遍历攻击，这可能会泄露他们网络服务器文件系统中的数据，如：服务器日志、全局可读文件以及潜在的其他敏感信息。攻击者可以制作一个带有文件路径的恶意URL，streamlit服务器将处理该URL并返回该文件的内容或覆盖Web服务器上的现有文件。这个问
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
streamlit streamlit >= 0.63.0, < 1.11.1 -

II. Public POCs for CVE-2022-35918

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-35918

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-35918 (1)

Vendor Advisories for CVE-2022-35918 (1)

IV. Related Vulnerabilities

Same product: streamlit
Same vendor: streamlit
Same weakness: CWE-22

V. Comments for CVE-2022-35918

No comments yet

Leave a comment