8.1
CVE-2026-34783
- EPSS 0.51%
- Veröffentlicht 06.04.2026 16:04:24
- Zuletzt bearbeitet 14.04.2026 20:28:17
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginFerret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites
Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Montferret ≫ Ferret SwPlatformgo Version < 2.0.0
Montferret ≫ Ferret Version2.0.0 Updatealpha1 SwPlatformgo
Montferret ≫ Ferret Version2.0.0 Updatealpha2 SwPlatformgo
Montferret ≫ Ferret Version2.0.0 Updatealpha3 SwPlatformgo
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.51% | 0.396 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 8.1 | 2.8 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73 External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j
https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917