Arbitrary local file read vulnerability during template rendering - swig-templates - CVE-2023-25345

Description

Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.

Recommendation

No fix is available yet. Followings are affected versions:

<= 2.0.4

References

GHSA-2rq5-699j-x7p6
CVE-2023-25345
CWE-22
CAPEC-310
OWASP 2021-A1
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Arbitrary local file read vulnerability during template rendering - swig-templates and gives you actionable findings to investigate.

Start a free scan

Related Issues

Arbitrary local file read vulnerability during template rendering - CVE-2023-25345
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr - Vulnerability
Gatsby develop server has Local File Inclusion vulnerability - CVE-2023-34238
FUXA vulnerable to Local File Inclusion - CVE-2023-31716

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

See something that needs correcting? Let us knowUpdated March 20, 2023