{"id":"CVE-2023-29159","aliases":["CLSA-2026-1787300457","CLSA-2026-1789447406","DEBIAN-CVE-2023-29159","EUVD-2023-0245","GHSA-v5gw-mw7f-84px","PYSEC-2023-83","UBUNTU-CVE-2023-29159"],"status":"published","title":"Starlette has Path Traversal vulnerability in StaticFiles","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02593,"percentile":0.85421,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-05-17T03:49:14Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"PyPI","package":"starlette","fixed_in":["0.27.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"starlette","fixed_in":["0.26.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"starlette","fixed_in":["0.28.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"starlette","fixed_in":["0.28.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.5"},{"fixed":"0.27.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.6"},{"fixed":"0.13.6.post4+tuxcare"}]}],"versions":["0.13.6","0.13.6.post1+tuxcare","0.13.6.post2+tuxcare","0.13.6.post3+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.0"},{"fixed":"0.25.0.post1+tuxcare"}]}],"versions":["0.25.0"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-1+deb12u1"}]}],"versions":["0.26.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.5"},{"fixed":"0.27.0"}]}],"versions":["0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1"]},{"source":"osv","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.5"},{"fixed":"0.27.0"}]}],"versions":["0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.1-1","0.16.0-1","0.18.0-1"]}],"products":[{"vendor":"encode","product":"starlette"}],"references":[{"url":"https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px","tags":["x_transferred","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/encode/starlette/releases/tag/0.27.0","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://jvn.jp/en/jp/JVN95981715/","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://github.com/encode/starlette/commit/1797de464124b090f10cf570441e8292936d63e3","tags":["web"]},{"url":"https://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29159","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2023-83.yaml","tags":["web"]},{"url":"https://jvn.jp/en/jp/JVN95981715","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v5gw-mw7f-84px"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29159.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-29159","tags":["advisory"]},{"url":"https://github.com/encode/starlette","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-29159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29159","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-29159","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","status":"published","published":"2023-06-01T00:00:00Z","modified":"2025-01-09T19:18:29.375Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:28.643185Z"}],"euvd":[{"id":"EUVD-2023-0245","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","status":"published","published":"2023-06-01T00:00:00Z","modified":"2025-01-09T19:18:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:22.603579Z"}],"ghsa":[{"id":"GHSA-v5gw-mw7f-84px","title":"Starlette has Path Traversal vulnerability in StaticFiles","description":"### Summary\nWhen using `StaticFiles`, if there's a file or directory that starts with the same name as the `StaticFiles` directory, that file or directory is also exposed via `StaticFiles` which is a path traversal vulnerability.\n\n### Details\nThe root cause of this issue is the usage of `os.path.commonprefix()`:\nhttps://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174\n\nAs stated in the Python documentation (https://docs.python.org/3/library/os.path.html#os.path.commonprefix) this function returns the longest prefix common to paths.\n\nWhen passing a path like `/static/../static1.txt`, `os.path.commonprefix([full_path, directory])` returns `./static` which is the common part of `./static1.txt` and `./static`, It refers to `/static/../static1.txt` because it is considered in the staticfiles directory. As a result, it becomes possible to view files that should not be open to the public.\n\nThe solution is to use `os.path.commonpath` as the Python documentation explains that `os.path.commonprefix` works a character at a time, it does not treat the arguments as paths.\n\n### PoC\nIn order to reproduce the issue, you need to create the following structure:\n\n```\n├── static\n│   ├── index.html\n├── static_disallow\n│   ├── index.html\n└── static1.txt\n```\n\nAnd run the `Starlette` app with:\n\n```py\nimport uvicorn\nfrom starlette.applications import Starlette\nfrom starlette.routing import Mount\nfrom starlette.staticfiles import StaticFiles\n\n\nroutes = [\n    Mount(\"/static\", app=StaticFiles(directory=\"static\", html=True), name=\"static\"),\n]\n\napp = Starlette(routes=routes)\n\n\nif __name__ == \"__main__\":\n    uvicorn.run(app, host=\"0.0.0.0\", port=8000)\n```\n\nAnd running the commands:\n\n```shell\ncurl --path-as-is 'localhost:8000/static/../static_disallow/'\ncurl --path-as-is 'localhost:8000/static/../static1.txt'\n```\nThe `static1.txt` and the directory `static_disallow` are exposed.\n\n### Impact\nConfidentiality is breached: An attacker may obtain files that should not be open to the public.\n\n### Credits\nSecurity researcher **Masashi Yamane of LAC Co., Ltd** reported this vulnerability to **JPCERT/CC Vulnerability Coordination Group** and they contacted us to coordinate a patch for the security issue.\n","status":"published","published":"2023-05-17T03:49:14Z","modified":"2024-10-28T14:29:32Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:13.90937Z"}],"nvd":[{"id":"CVE-2023-29159","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","status":"published","published":"2023-06-01T02:15:09.803Z","modified":"2026-06-17T05:49:30.557Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:03.795015Z"}],"osv":[{"id":"CVE-2023-29159","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","status":"published","published":"2023-06-01T00:00:00Z","modified":"2026-10-28T02:31:04.189629744Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-29159","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","status":"published","published":"2023-06-01T02:15:09.803Z","modified":"2026-10-26T18:01:47.538029327Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-v5gw-mw7f-84px","title":"Starlette has Path Traversal vulnerability in StaticFiles","description":"### Summary\nWhen using `StaticFiles`, if there's a file or directory that starts with the same name as the `StaticFiles` directory, that file or directory is also exposed via `StaticFiles` which is a path traversal vulnerability.\n\n### Details\nThe root cause of this issue is the usage of `os.path.commonprefix()`:\nhttps://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174\n\nAs stated in the Python documentation (https://docs.python.org/3/library/os.path.html#os.path.commonprefix) this function returns the longest prefix common to paths.\n\nWhen passing a path like `/static/../static1.txt`, `os.path.commonprefix([full_path, directory])` returns `./static` which is the common part of `./static1.txt` and `./static`, It refers to `/static/../static1.txt` because it is considered in the staticfiles directory. As a result, it becomes possible to view files that should not be open to the public.\n\nThe solution is to use `os.path.commonpath` as the Python documentation explains that `os.path.commonprefix` works a character at a time, it does not treat the arguments as paths.\n\n### PoC\nIn order to reproduce the issue, you need to create the following structure:\n\n```\n├── static\n│   ├── index.html\n├── static_disallow\n│   ├── index.html\n└── static1.txt\n```\n\nAnd run the `Starlette` app with:\n\n```py\nimport uvicorn\nfrom starlette.applications import Starlette\nfrom starlette.routing import Mount\nfrom starlette.staticfiles import StaticFiles\n\n\nroutes = [\n    Mount(\"/static\", app=StaticFiles(directory=\"static\", html=True), name=\"static\"),\n]\n\napp = Starlette(routes=routes)\n\n\nif __name__ == \"__main__\":\n    uvicorn.run(app, host=\"0.0.0.0\", port=8000)\n```\n\nAnd running the commands:\n\n```shell\ncurl --path-as-is 'localhost:8000/static/../static_disallow/'\ncurl --path-as-is 'localhost:8000/static/../static1.txt'\n```\nThe `static1.txt` and the directory `static_disallow` are exposed.\n\n### Impact\nConfidentiality is breached: An attacker may obtain files that should not be open to the public.\n\n### Credits\nSecurity researcher **Masashi Yamane of LAC Co., Ltd** reported this vulnerability to **JPCERT/CC Vulnerability Coordination Group** and they contacted us to coordinate a patch for the security issue.\n","status":"published","published":"2023-05-17T03:49:14Z","modified":"2026-07-08T06:53:10.504182631Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"UBUNTU-CVE-2023-29159","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","status":"published","published":"2023-06-01T02:15:00Z","modified":"2025-09-08T16:56:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"CLSA-2026-1787300457","title":"TuxCare security update for starlette (3 CVEs)","description":"TuxCare rebuilt starlette to address 3 CVEs. Fixed in 0.13.6.post4+tuxcare.","status":"published","published":"2026-08-21T08:20:57Z","modified":"2026-10-15T09:47:40.94707589Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1789447406","title":"TuxCare security update for starlette (8 CVEs)","description":"TuxCare rebuilt starlette to address 8 CVEs. Fixed in 0.25.0.post1+tuxcare.","status":"published","published":"2026-09-15T04:43:26Z","modified":"2026-10-15T09:48:01.789333066Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"PYSEC-2023-83","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","status":"published","published":"2023-06-01T02:15:00Z","modified":"2023-11-08T04:12:16.846611Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}