CVE-2024-39903CWE-22

Local File Inclusion in Solara

High · published July 12, 2024

CVSS v3.1
8.6
EPSS
3%
Percentile
86.8
In the wild
Unconfirmed
What it is

Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02884 · 86.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-07-12T14:28Z
EPSS history
Timeline
  • 12 JUL 14:28Z
    Local File Inclusion in Solara
    cvelistv5