CVE-2023-40274

    Dashboard / Vulnerabilities / CVE-2023-40274

    CVE-2023-40274

    Published: 14 Aug 2023Last Modified: 12 Aug 2026

    Summary:

    Details: An issue was discovered in zola 0.13.0 through 0.17.2. The custom implementation of a web server, available via the "zola serve" command, allows directory traversal. The handle_request function, used by the server to process HTTP requests, does not account for sequences of special path control characters (../) in the URL when serving a file, which allows one to escape the webroot of the server and read arbitrary files from the filesystem.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40274.json, https://nvd.nist.gov/vuln/detail/CVE-2023-40274, https://github.com/getzola/zola/issues/2257, https://github.com/getzola/zola/pull/2258

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 1ef8c85f53b4988fdafc0e6271cce590515d55aa
    Fixed -7c6bdc1019dbfa1c59667dd6ba0cacf30774b41b

    Affected versions

    v0.17.1
    v0.17.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-40274 | CVE-DB