CVE-2026-23537 Feast: unauthenticated arbitrary file write
Unauthenticated attackers can write arbitrary files to the Feast Feature Server, potentially overwriting configurations to achieve remote code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23537?
CVE-2026-23537 is a critical path traversal vulnerability in Feast Feature Server, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.
Weakness: CWE-862
Which versions are affected by CVE-2026-23537?
How do I fix CVE-2026-23537?
No fix has been published for CVE-2026-23537 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23537 being exploited?
There is no known exploitation of CVE-2026-23537 in the wild and no public exploit code.
Sources
Also known as GHSA-4m9c-5f58-453x.