CVE-2022-35918

    Dashboard / Vulnerabilities / CVE-2022-35918

    CVE-2022-35918

    Published: 1 Aug 2022Last Modified: 12 Aug 2026

    Summary: Streamlit directory traversal vulnerability

    Details: Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35918.json, https://github.com/streamlit/streamlit/security/advisories/GHSA-v4hr-4jpx-56gc, https://nvd.nist.gov/vuln/detail/CVE-2022-35918, https://github.com/streamlit/streamlit/commit/80d9979d5f4a00217743d607078a1d867fad8acf

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 417b501171938ac556b01db028f61a934f5b4351
    Fixed -b6429b6f03c212fd38496b429d20e0d986877e4c

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35918 | CVE-DB