CVE-2022-35918: Streamlit directory traversal vulnerability
Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-35918?
CVE-2022-35918 is a vulnerability in Streamlit, a data-oriented application development framework for Python, that allows for a directory traversal attack.
What can happen if I am affected by CVE-2022-35918?
If you are affected by CVE-2022-35918, an attacker could potentially leak data from your web server file system, including server logs and world-readable files.
How does CVE-2022-35918 affect Streamlit?
CVE-2022-35918 affects Streamlit versions 0.63.0 to 1.11.1 that use custom components.
What is the severity of CVE-2022-35918?
CVE-2022-35918 has a severity level of medium, with a severity value of 6.5.
How can I fix CVE-2022-35918?
To fix CVE-2022-35918, upgrade to a version of Streamlit that is not affected by this vulnerability and avoid using custom components.