CVE-2023-4914 Relative Path Traversal in cecilapp/cecil
An attacker can exploit relative path traversal in Cecil to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-4914?
CVE-2023-4914 is a medium-severity path traversal vulnerability in cecilapp/cecil, published on 12 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.
Which versions are affected by CVE-2023-4914?
2 open source packages ship an affected version, including cecil/cecil. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cecil/cecil Packagist | All versions | 7.47.1 |
cecil/cecil Packagist | All versions | 7.47.1 |
Products include Cecil Cecil.
How do I fix CVE-2023-4914?
Upgrade cecil/cecil to 7.47.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-4914 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4914 exists.
Other vulnerabilities in cecilapp/cecil
Sources
Also known as GHSA-q8hr-4w58-985p.