CVE-2020-37041 OpenCTI 3.3.1 - Directory Traversal

What is CVE-2020-37041?

CVE-2020-37041 is a high-severity path traversal vulnerability in Filigran OpenCTI, published on 30 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences (e.g., '../') in the URL. For example, requesting /static/css//../../../../../../../../etc/passwd returns the contents of /etc/passwd. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.

Weakness: CWE-22

Which versions are affected by CVE-2020-37041?

1 open source package ship an affected version, including pycti. It affects 1 product.

Products include Citeum Opencti.

How do I fix CVE-2020-37041?

No fix has been published for CVE-2020-37041 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-37041 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37041 exists.

Other vulnerabilities in Filigran OpenCTI

• CVE-2026-27960 OpenCTI privilege escalation and unauthenticated access via default admin account Critical 9.8
• CVE-2026-39980 OpenCTI affected by RCE via notifier template Critical 9.1
• CVE-2025-24977 OpenCTI has remote code execution and sensitive secrets exposed through web hook Critical 9.1
• CVE-2024-26139 OpenCTI Authenticated Privilege Escalation High 8.3
• CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wvqh-8vgx-x89q, PYSEC-2026-114.