PYSEC-2026-2420
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/cloakbrowser/PYSEC-2026-2420.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2420
- Aliases
- Published
- 2026-07-13T15:19:08Z
- Modified
- 2026-07-13T16:31:42Z
- Severity
-
- 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
- Details
-
The
cloakserveCDP multiplexer uses the user-suppliedfingerprintquery parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a craftedfingerprintvalue containing path traversal sequences to resolveuser_data_diroutside the configureddata_dir. When Chrome fails to start or the process is cleaned up,shutil.rmtree()deletes the traversed path, resulting in arbitrary directory deletion.Additionally,
cloakservebound to0.0.0.0by default, making it network-exposed.Impact
An attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user.
Patches
Fixed in v0.3.28.
Mitigations
- Upgrade to v0.3.28 or later
- Restrict network access to the cloakserve port
- References
Affected packages
PyPI / cloakbrowser
Package
- Name
- cloakbrowser
- View open source insights on deps.dev
- Purl
- pkg:pypi/cloakbrowser
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.3.28
Affected versions
0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.20
0.3.21
0.3.22
0.3.23
0.3.24
0.3.25
0.3.26
0.3.27