GHSA-c8f7-x2g7-7fxj
Phoenix-ws source code and data in extensions folder is publicly available
Impact
All of the source code, files, and folders in phoenix_files/extensions/ are available to end users through a simple HTTP GET request.
Patches
The issue has been patched. The users of version 1.0.6 and above are not effected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Phoenix-ws source code and data in extensions folder is publicly available
Impact
All of the source code, files, and folders in phoenix_files/extensions/ are available to end users through a simple HTTP GET request.
Patches
The issue has been patched. The users of version 1.0.6 and above are not effected.
- Record
GHSA-c8f7-x2g7-7fxj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Phoenix-ws source code and data in extensions folder is publicly available
Impact
All of the source code, files, and folders in phoenix_files/extensions/ are available to end users through a simple HTTP GET request.
Patches
The issue has been patched. The users of version 1.0.6 and above are not effected.
- Record
GHSA-c8f7-x2g7-7fxj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phoenix-wsPyPI | before 1.0.6 | 1.0.6 |
phoenix-wsPyPI | before 1.0.6, plus listed versions 1.0.41.0.4.1 | 1.0.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-c8f7-x2g7-7fxj is a high vulnerability (CVSS 7.5) in phoenix-ws, published June 2, 2022. No source lists public exploit code. Fixed in phoenix-ws 1.0.6.