CVE-2023-35843

Deeper analysis

NocoDB through version 0.106.0, or alternatively 0.109.1, contains a path traversal vulnerability tracked as CVE-2023-35843 and assigned CWE-22. The flaw resides in the attachment handling code that processes the path parameter on the /download route, enabling an unauthenticated remote attacker to supply crafted input that resolves outside the intended directory and retrieves arbitrary server files. The issue carries a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, and no required privileges or user interaction, with impacts limited to high confidentiality loss.

An attacker can therefore send a single unauthenticated HTTP request that manipulates the path parameter to read sensitive files such as configuration data, source code, or other server content. Because the vulnerability requires no authentication and is reachable over the network, it can be exploited by any party able to reach the NocoDB instance, potentially exposing credentials or intellectual property stored on the host.

Public references, including advisory.dw1.io/60 and the affected attachment controller implementations in the NocoDB repository, document the vulnerable code paths but do not detail specific patch versions or mitigation steps beyond the version bounds already stated in the CVE description. The associated EPSS score remains high, with a current value of 0.9196 and a peak of 0.9237; no material rise from a low baseline is observable in the supplied data.