CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2023-6021
High (7.5) in ray project ray. EPSS 37% chance of exploitation in the next 30 days. Fixed in ray 2.8.1.
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Severity
- EPSS
- 37% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-22, CWE-29
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ray_project:ray
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3pww-qvr8-6mhp | PyPI | ray | <2.8.1 | 2.8.1 |
| PYSEC-2026-515 | PyPI | ray | <2.8.1 | 2.8.1 |