CVE-2022-35918

Description

Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file or overwrite existing files on the web-server. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

How to fix CVE-2022-35918

To remediate CVE-2022-35918, upgrade the affected package to a fixed version below.

• —upgrade to 1.11.1 or later
• —upgrade to 80d9979d5f4a00217743d607078a1d867fad8acf or later

Is CVE-2022-35918 being exploited?

Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 0.63.0, < 1.11.1
• from 0, < 80d9979d5f4a00217743d607078a1d867fad8acf | >= 0.63.0, < 1.11.1

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-35918
• PATCHgithub.com/streamlit/streamlit
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/streamlit/PYSEC-2022-248.yaml
• WEBgithub.com/streamlit/streamlit/commit/80d9979d5f4a00217743d607078a1d867fad8acf