CVE-2024-39903 Local File Inclusion in Solara
Attackers can read arbitrary local files by exploiting a path traversal flaw in Solara's static file serving mechanism.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39903?
CVE-2024-39903 is a high-severity path traversal vulnerability in widgetti solara, published on 12 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
Weakness: CWE-22
Which versions are affected by CVE-2024-39903?
3 open source packages ship an affected version, including solara. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
solara PyPI | All versions | 1.35.1 |
solara PyPI | All versions | 1.35.1 |
solara PyPI | All versions | 1.35.1 |
Products include Widgetti Solara.
How do I fix CVE-2024-39903?
Upgrade solara to 1.35.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-39903 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39903 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-9794-pc4r-438w, PYSEC-2026-1933.