OTel Sentry Exporter Path Traversal (CVE-2025-47256)

Vulnerability Summary: Path Traversal Vulnerability in Sentry Exporter Vulnerability Overview Vulnerability Name: Path traversal in the Sentry exporter via attacker-controllable , allowing access to privileged Sentry API endpoints (using the bearer token configured for the operator). CVE ID: CVE-2025-47256 CVSS 3.1 Score: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Severity Level: Moderate (5.3/10) Affected Versions: = 0.154.0 Affected Package: Impact Scope Primary Attack Path: An attacker sends via OTLP; the URL becomes , enabling access to arbitrary Sentry API endpoints protected by the bearer token (e.g., ). Secondary Path: Sending results in after nginx normalization, allowing reads of organization/project metadata, member lists, etc. Impacts: - Integrity: The attacker can invoke admin endpoints reachable by the token (deleting members, modifying project settings, creating keys, etc.). - Confidentiality: Can read organization/project metadata, member lists, materials, etc. - Scope: When the Collector is configured to forward to a Sentry organization, cross-scope traversal is rejected. - The attack converts a low-privilege telemetry injection path into intra-org admin API access. Remediation Apply the existing to runtime-derived slugs, not just the config mapping: Or reject at URL construction time: Recommendation: Apply runtime regex validation to all runtime-derived URL components (including , if it may be attacker-influenced), not just the config mapping. Other Information Reporter: Independent security researcher Martin Brouder Related CWE: CWE-22 (Path Traversal), CWE-74 (Injection)

Goal Reached Thanks to every supporter — we hit 100%!

OTel Sentry Exporter Path Traversal (CVE-2025-47256)

More from this source