high7.5
CVE-2023-35844
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow ..
Impact
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lightdash | Lightdash | before 0.510.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://advisory.dw1.io/59
- https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c
- https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3
- https://github.com/lightdash/lightdash/pull/5090
- https://advisory.dw1.io/59
- https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c
- https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3
- https://github.com/lightdash/lightdash/pull/5090