CVE-2023-29159 Starlette has Path Traversal vulnerability in StaticFiles

What is CVE-2023-29159?

CVE-2023-29159 is a high-severity path traversal vulnerability in Encode Starlette, published on 1 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.

Weakness: CWE-22

Which versions are affected by CVE-2023-29159?

3 open source packages ship an affected version, including starlette. It affects 1 product.

Products include Encode Starlette.

How do I fix CVE-2023-29159?

Upgrade starlette to 0.27.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-29159 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-29159 exists.

Other vulnerabilities in Encode Starlette

• CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Exploited Medium 6.5
• CVE-2026-54283 Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS High 7.5
• CVE-2026-48818 Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows High 7.5
• CVE-2023-30798 MultipartParser DOS with too many fields or files in Starlette Framework High 7.5
• CVE-2026-48817 Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-29159, GHSA-v5gw-mw7f-84px, PYSEC-2023-83, UBUNTU-CVE-2023-29159.