CVE-2023-0290 Rapid7 Velociraptor directory traversal in client ID parameter
An investigator-level user can exploit directory traversal to schedule server-side collections, escalating privileges to administrator level.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0290?
CVE-2023-0290 is a medium-severity path traversal vulnerability in Rapid7 Velociraptor, published on 18 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client.
Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to "administrator" role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the "investigator" role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least "investigator" level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI.
This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.
Weakness: CWE-22
Which versions are affected by CVE-2023-0290?
3 open source packages ship an affected version, including www.velocidex.com/golang/velociraptor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
www.velocidex.com/golang/velociraptor Go | All versions | 0.6.7-5 |
www.velocidex.com/golang/velociraptor Go | All versions | 0.6.7-5 |
www.velocidex.com/golang/velociraptor Go | All versions | 0.6.7-5 |
Products include Rapid7 Velociraptor.
How do I fix CVE-2023-0290?
Upgrade www.velocidex.com/golang/velociraptor to 0.6.7-5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-0290 being exploited?
There is no known exploitation of CVE-2023-0290 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Velociraptor
- CVE-2023-0242 Insufficient permission check in the VQL copy() function
- CVE-2023-5950 Rapid7 Velociraptor Reflected XSS
- CVE-2026-5329 Rapid7 Velociraptor Improper Input Validation in Client Message Handler
- CVE-2026-6290 Velociraptor Query() Plugin Misapplies Permissions To Orgs
- CVE-2025-14728 Rapid7 Velociraptor Directory Traversal Vulnerability
Sources
Also known as GHSA-7jf5-fvgf-48c6, GO-2023-1502.