In short
- CVE-2024-39903 is a HIGH (CVSS 7.5) vulnerability affecting solara, solara (widgetti).
- Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 87.0% of all vulnerabilities.
- Fix: update to 1.35.1 or later.
| Package | Affected versions | Patched versions |
|---|
| solara PyPI | < 1.35.1
| 1.35.1
|
| solara | < 1.35.1
| 1.35.1
|
Description
A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
References
NVD description
Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free