CVE-2023-40274

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-40274
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40274.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-40274
Aliases
Downstream
CGA (2)
Related
Published
2023-08-14T00:00:00Z
Modified
2026-08-12T03:51:47Z
Summary
[none]
Details

An issue was discovered in zola 0.13.0 through 0.17.2. The custom implementation of a web server, available via the "zola serve" command, allows directory traversal. The handle_request function, used by the server to process HTTP requests, does not account for sequences of special path control characters (../) in the URL when serving a file, which allows one to escape the webroot of the server and read arbitrary files from the filesystem.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40274.json"
}
References

Affected packages

Git / github.com/getzola/zola

Affected ranges

Type
GIT
Repo
https://github.com/getzola/zola
Events
Introduced
1ef8c85f53b4988fdafc0e6271cce590515d55aa
Fixed
7c6bdc1019dbfa1c59667dd6ba0cacf30774b41b
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:getzola:zola:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0.13.0"
        },
        {
            "fixed":  "0.17.2"
        },
        {
            "last_affected":  "0.17.2"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*
v0.13.0
v0.14.0
v0.14.1
v0.15.0
v0.15.1
v0.15.3
v0.16.0
v0.16.1
v0.17.0
v0.17.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40274.json"