Directory traversal in mkdocs

HIGH 7.5CVE-2021-40978 · GHSA-qh9q-34h6-hcv9 · PYSEC-2021-878 · Published 07/10/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
mkdocs PyPI	`≥ 1.2.2, < 1.2.3`	`1.2.3`
mkdocs mkdocs	`= 1.2.2`	No fix yet

Description

The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information.

NVD description

The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1

References

nvd.nist.gov/vuln/detail/CVE-2021-40978 · ADVISORY
mkdocs/mkdocs · WEB
nisdn/CVE-2021-40978 · WEB
mkdocs/mkdocs#2604 · WEB
mkdocs/mkdocs commit 1b15412 · WEB
mkdocs/mkdocs commit 5754091 · WEB
mkdocs/mkdocs · PACKAGE
mkdocs/mkdocs release 1.2.3 · WEB
nisdn/CVE-2021-40978 · WEB
pypa/advisory-database · WEB
GitHub Advisory GHSA-qh9q-34h6-hcv9 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free