PYSEC-2026-2035
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/weave/PYSEC-2026-2035.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2035
- Aliases
- Published
- 2026-07-07T14:34:38.008803Z
- Modified
- 2026-07-07T17:46:23.961608143Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Weave server API vulnerable to arbitrary file leak
- Details
-
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2024-7340
- https://github.com/wandb/weave/pull/1657
- https://github.com/wandb/weave/commit/f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f
- https://github.com/wandb/weave
- https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248
- https://pypi.org/project/weave
- https://github.com/advisories/GHSA-r49h-6qxq-624f
Affected packages
PyPI / weave
Package
- Name
- weave
- View open source insights on deps.dev
- Purl
- pkg:pypi/weave
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.50.8
Affected versions
0.*
0.20.0.dev1
0.20.0.dev2
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.26.0
0.27.0
0.28.0
0.29.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.38.0
0.39.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.50.0
0.50.1
0.50.2
0.50.3
0.50.4
0.50.5
0.50.6
0.50.7