CVE-2023-35843
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route.
Risk Assessment
This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.
Recommendation
It is recommended to update NocoDB to the latest version to mitigate this vulnerability and to monitor server access for potential attack attempts.
Original NVD description (English source)
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.