CVE-2023-27588— Unauthenticated path traversal vulnerability in Hasura GraphQL Engine
Quick assessment
Affected
hasura graphql-engine
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hasura GraphQL Engine是Hasura开源的一个非常快速的 GraphQL 服务器。 Hasura GraphQL Engine 存在安全漏洞，该漏洞源于存在路径遍历漏洞。
Possible ATT&CK Techniques 1 AI
T1552.001 · Credentials In Files
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-27588
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated path traversal vulnerability in Hasura GraphQL Engine
Source: CVE Program / CVE List V5
Vulnerability Description
Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
路径遍历：’dir/../../filename’
Source: CVE Program / CVE List V5
Vulnerability Title
Hasura GraphQL Engine 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Hasura GraphQL Engine是Hasura开源的一个非常快速的 GraphQL 服务器。 Hasura GraphQL Engine 存在安全漏洞，该漏洞源于存在路径遍历漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| hasura | graphql-engine | < 1.3.4 | - |
|
II. Public POCs for CVE-2023-27588
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-27588
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-27588 (1)
Vendor Advisories for CVE-2023-27588 (1)
-
https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x x_refsource_CONFIRM
Other References for CVE-2023-27588 (4)
-
https://github.com/hasura/graphql-engine/releases/tag/v1.3.4 x_refsource_MISC
-
https://github.com/hasura/graphql-engine/releases/tag/v2.20.1 x_refsource_MISC
-
https://github.com/hasura/graphql-engine/releases/tag/v2.11.5 x_refsource_MISC
-
https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: hasura
-
CVE-2026-54698
Hasura: Row-level authorization bypass on table computed fie -
CVE-2021-47748
Hasura GraphQL 1.3.3 - Remote Code Execution -
CVE-2021-47715
Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote -
CVE-2021-47714
Hasura GraphQL 1.3.3 Local File Read via SQL Injection -
CVE-2021-47713
Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL
Same weakness: CWE-27
-
CVE-2026-17495
moment vulnerable to Path Traversal via crafted non-string l -
CVE-2026-76344
Path Traversal through the Search Dispatch REST API in Splun -
CVE-2026-20018
Cisco Firepower Management Center Software and Firepower Thr -
CVE-2025-66518
Apache Kyuubi: Unauthorized directory access due to missing -
CVE-2025-58292
Huawei HarmonyOS 安全漏洞
V. Comments for CVE-2023-27588
No comments yet