Arbitrary file read un Vapor
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 1.5%
exploitation probability
1.5%top 28% of all CVEs
observed exploitation
nono source reports it
In short
Vapor web framework versions before 4.29.4 have a flaw in FileMiddleware that allows attackers to read any file on the server by manipulating file paths. This is dangerous because attackers can access sensitive data like configuration files or private keys.
Technical detail
Path traversal vulnerability in Vapor's FileMiddleware (CWE-22) allows unauthenticated attackers to bypass directory restrictions and read arbitrary files on the filesystem. The vulnerability requires only that FileMiddleware is enabled; exploitation occurs through crafted requests with path traversal sequences that are not properly sanitized before file access.
Summary generated and translated by AI from the official description.
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Affected products
vapor · vapor