{"id":"CVE-2024-39903","aliases":["EUVD-2024-2307","GHSA-9794-pc4r-438w","PYSEC-2026-1933"],"status":"published","title":"Local File Inclusion in Solara","description":"Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version \u003c1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02884,"percentile":0.86981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-07-12T14:28:15Z","modified":"2026-10-28T02:31:07Z","exploits":[{"source":"nuclei","id":"CVE-2024-39903","title":"Solara \u003c1.35.1 - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39903.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"solara","fixed_in":["1.35.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"solara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"solara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.1"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.1.0","0.1.1","0.1.2","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.11.0","0.12.0","0.12.1","0.13.0","0.14.0","0.15.0","0.16.0","0.17.0","0.18.0","0.18.1","0.18.2","0.18.3","0.19.0","0.19.1","0.2.0","0.3.0","0.4.0","0.4.1","0.4.3a4","0.5.0","0.5.0a0","0.5.1","0.5.2","0.7.0","0.8.0","0.8.1","0.9.0","0.9.1","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.10.0","1.11.0","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.16.1","1.16.2","1.16.3","1.17.0","1.17.1","1.17.2","1.17.3","1.17.4","1.17.5","1.18.0","1.19.0","1.2.0","1.2.1","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.25.0","1.25.1","1.26.0","1.26.1","1.27.0","1.28.0","1.29.0","1.29.1","1.3.0","1.30.0","1.30.1","1.31.0","1.32.0","1.32.1","1.32.2","1.33.0","1.34.0","1.34.1","1.35.0","1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"solara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.1"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.1.0","0.1.1","0.1.2","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.11.0","0.12.0","0.12.1","0.13.0","0.14.0","0.15.0","0.16.0","0.17.0","0.18.0","0.18.1","0.18.2","0.18.3","0.19.0","0.19.1","0.2.0","0.3.0","0.4.0","0.4.1","0.4.3a4","0.5.0","0.5.0a0","0.5.1","0.5.2","0.7.0","0.8.0","0.8.1","0.9.0","0.9.1","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.10.0","1.11.0","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.16.1","1.16.2","1.16.3","1.17.0","1.17.1","1.17.2","1.17.3","1.17.4","1.17.5","1.18.0","1.19.0","1.2.0","1.2.1","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.25.0","1.25.1","1.26.0","1.26.1","1.27.0","1.28.0","1.29.0","1.29.1","1.3.0","1.30.0","1.30.1","1.31.0","1.32.0","1.32.1","1.32.2","1.33.0","1.34.0","1.34.1","1.35.0","1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.9.0"]}],"products":[{"vendor":"widgetti","product":"solara"}],"references":[{"url":"https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39903","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9794-pc4r-438w","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39903.json","tags":["advisory"]},{"url":"https://github.com/widgetti/solara","tags":["package"]},{"url":"https://pypi.org/project/solara","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-39903","title":"Local File Inclusion in Solara","description":"Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version \u003c1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.","status":"published","published":"2024-07-12T14:28:15.073Z","modified":"2024-08-02T04:33:11.21Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-2307","description":"Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version \u003c1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.","status":"published","published":"2024-07-12T14:28:15Z","modified":"2024-08-02T04:33:11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T03:50:17.469599Z"}],"ghsa":[{"id":"GHSA-9794-pc4r-438w","title":"Local File Inclusion in Solara","description":"A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version \u003c1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system. \n\n### References\n- https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w\n- https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54\n- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39903","status":"published","published":"2024-07-12T21:00:21Z","modified":"2024-07-12T21:00:23Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:56.530214Z"}],"nvd":[{"id":"CVE-2024-39903","description":"Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version \u003c1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.","status":"published","published":"2024-07-12T15:15:11.177Z","modified":"2026-06-17T07:42:59.747Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:12.994089Z"}],"osv":[{"id":"CVE-2024-39903","title":"Local File Inclusion in Solara","description":"Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version \u003c1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.","status":"published","published":"2024-07-12T14:28:15.073Z","modified":"2026-10-28T02:31:07.835239774Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-9794-pc4r-438w","title":"Local File Inclusion in Solara","description":"A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version \u003c1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system. \n\n### References\n- https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w\n- https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54\n- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39903","status":"published","published":"2024-07-12T21:00:21Z","modified":"2026-09-10T03:50:16.472624922Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"PYSEC-2026-1933","title":"Local File Inclusion in Solara","description":"A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version \u003c1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system. \n\n### References\n- https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w\n- https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54\n- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39903","status":"published","published":"2026-07-07T14:34:36.733565Z","modified":"2026-07-07T17:47:08.750115253Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}