CVE-2023-34457 MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form
A malicious web server can read arbitrary files on the client by exploiting file input fields in HTML forms during automated interactions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34457?
CVE-2023-34457 is a medium-severity vulnerability in MechanicalSoup, published on 5 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.
Weakness: CWE-20
Which versions are affected by CVE-2023-34457?
3 open source packages ship an affected version, including mechanicalsoup and MechanicalSoup. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mechanicalsoup PyPI | All versions | 1.3.0 |
mechanicalsoup PyPI | From 0.2.0 | 1.3.0 |
MechanicalSoup PyPI | From 0.2.0 | 1.3.0 |
Linux distribution packages (1)
python-MechanicalSoup openSUSE:Tumbleweed | All versions | 1.4.0-2.4 |
Products include Mechanicalsoup Project Mechanicalsoup.
How do I fix CVE-2023-34457?
Upgrade mechanicalsoup to 1.3.0 or later.
Is CVE-2023-34457 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34457 exists.
Sources
Also known as DEBIAN-CVE-2023-34457, GHSA-x456-3ccm-m6j4, PYSEC-2023-108, UBUNTU-CVE-2023-34457, openSUSE-SU-2024:13499-1, openSUSE-SU-2026:11993-1.