CVE-2020-15523 Path traversal in n/a

What is CVE-2020-15523?

CVE-2020-15523 is a high-severity path traversal vulnerability in Netapp Snapcenter, published on 4 Jul 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.

Weakness: CWE-908, CWE-427

Which versions are affected by CVE-2020-15523?

3 open source packages ship an affected version, including libpython, python and python-min. It affects 2 products.

Products include Netapp Snapcenter, Python Python.

How do I fix CVE-2020-15523?

Upgrade libpython to a fixed version for your release line: 3.5.10, 3.6.12, 3.7.9 or 3.8.4.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-15523 being exploited?

There is no known exploitation of CVE-2020-15523 in the wild and no public exploit code.

Other vulnerabilities in Netapp Snapcenter

• CVE-2025-26512 CVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter Critical 9.9
• CVE-2023-1096 Auth bypass in SnapCenter Critical 9.8
• CVE-2023-27316 Privilege Escalation Vulnerability in SnapCenter High 8.8
• CVE-2023-27313 Privilege Escalation Vulnerability in SnapCenter High 8.3
• CVE-2022-38732 Security feature bypass in SnapCenter High 7.5

All Netapp Snapcenter vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-libpython-2020-15523, BIT-python-2020-15523, BIT-python-min-2020-15523, GHSA-mj5j-j2qm-c8g4, PSF-2020-4.