CVE Catalog
CVE-2023-35844
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk5.73%
92th percentile - higher than 92% of all known CVEs
Summary
Lightdash versions before 0.510.3 have insecure file endpoints that allow directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
Risk Assessment
The organization may be exposed to unauthorized file access and potential data leaks, leading to serious legal and reputational consequences.
Recommendation
It is recommended to upgrade Lightdash to version 0.510.3 or later and implement additional security measures to prevent directory traversal attacks.
Original NVD description (English source)
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.