CVE-2020-37214 Voyager 1.3.0 - Directory Traversal
Attackers can read arbitrary system files via path manipulation in the Voyager admin asset endpoint, exposing sensitive configuration data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-37214?
CVE-2020-37214 is a high-severity path traversal vulnerability in The Control Group Voyager, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Voyager 1.3.0 contains a directory traversal vulnerability that allows attackers to access sensitive system files by manipulating the asset path parameter. Attackers can exploit the path parameter in /admin/voyager-assets to read arbitrary files like /etc/passwd and .env configuration files.
Weakness: CWE-22
Which versions are affected by CVE-2020-37214?
How do I fix CVE-2020-37214?
No fix has been published for CVE-2020-37214 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-37214 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37214 exists.
Sources
Also known as GHSA-w79v-5572-69vq.