ZDF
Sign inSign up

Vulnerabilities

Security incident · GHSA-v5gw-mw7f-84px

Path traversal vulnerability in StaticFiles

Published May 16, 2023 · catalog updated Aug 26, 2025 · Path traversal vulnerability in

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-v5gw-mw7f-84px. A missing EPSS score is not a low risk. Compare Path traversal vulnerability in with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Path traversal vulnerability in).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Low3.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Version ranges on file
Affected products
pip starlette

### Summary When using , if there's a file or directory that starts with the same name as the directory, that file or directory is also exposed via which is a path traversal vulnerability. ### Details The root cause of this issue is the usage of : https://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174 As stated in the Python documentation (https://docs.python.org/3/library/os.path.html#os.path.commonprefix) this function returns the longest prefix common to paths. When passing a path like , returns which is the common part of and , It refers to because it is considered in the staticfiles directory. As a result, it becomes possible to view files that should not be open to the public. The solution is to use as the Python documentation explains that works a character at a time, it does not treat the arguments as paths. ### PoC In order to reproduce the issue, you need to create the following structure: And run the app with: And running the commands: The and the directory are exposed. ### Impact Confidentiality is breached: An attacker may obtain files that should not be open to the public. ### Credits Security researcher **Masashi Yamane of LAC Co., Ltd** reported this vulnerability to **JPCERT/CC Vulnerability Coordination Group** and they contacted us to coordinate a patch for the security issue.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • pip starlette>=0.13.5

How to fix GHSA-v5gw-mw7f-84px

  • No stored fix

    No vendor fix text is stored. Use the linked advisory before you change production.

  • Version check

    Seen in >=0.13.5

  • Advisory

    Open the inventory_github record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for GHSA-v5gw-mw7f-84px. A missing EPSS score is not a low risk. Compare Path traversal vulnerability in with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with >=0.13.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Starlette security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 16, 2023 · Maintainer security tabs

    Detected

    ### Summary When using , if there's a file or directory that starts with the same name as the directory, that file or directory is also exposed via which is a path traversal vulnerability. ### Details The root cause of this issue is the usage of : https://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174 As stated in the Python documentati

  2. Aug 26, 2025 · Maintainer security tabs

    Updated

    ### Summary When using , if there's a file or directory that starts with the same name as the directory, that file or directory is also exposed via which is a path traversal vulnerability. ### Details The root cause of this issue is the usage of : https://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174 As stated in the Python documentati

Sources

  • Maintainer security tabsVendor advisoryGHSA-v5gw-mw7f-84px

    ### Summary When using , if there's a file or directory that starts with the same name as the directory, that file or directory is also exposed via which is a path traversal vulnerability. ### Details The root cause of this issue is the usage of : https://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174 As stated in the Python documentati

    github.com

Freshness

Last verified in this catalog Aug 26, 2025. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026