CVE-2024-39903

Advisory

A Local File Inclusion (LFI) vulnerability affects widgetti/solara. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-9794-pc4r-438w
• https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39903