CVE-2023-34457

    Dashboard / Vulnerabilities / CVE-2023-34457

    CVE-2023-34457

    Published: 5 Jul 2023Last Modified: 12 Aug 2026

    Summary: MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form

    Details: MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.

    References: https://github.com/MechanicalSoup/MechanicalSoup/releases/tag/v1.3.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34457.json, https://github.com/MechanicalSoup/MechanicalSoup/security/advisories/GHSA-x456-3ccm-m6j4, https://nvd.nist.gov/vuln/detail/CVE-2023-34457, https://security.netapp.com/advisory/ntap-20230803-0005/, https://github.com/MechanicalSoup/MechanicalSoup/commit/d57c4a269bba3b9a0c5bfa20292955b849006d9e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ee34e666db1c816af54e6a1fdc4544dc10385405
    Fixed -16238f4b726a09563150a2a818cded51ac7d7c1f

    Affected versions

    v1.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-34457 | CVE-DB