CVE-2023-35844

7.5 highEPSS 6.3%

High (7.5) in lightdash lightdash. EPSS 6.3% chance of exploitation in the next 30 days.

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 6.3% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2023-06-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lightdash:lightdash

References

https://advisory.dw1.io/59
https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c
https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3
https://github.com/lightdash/lightdash/pull/5090
https://advisory.dw1.io/59

Check your stack JSON