CVE-2023-35844

Deeper analysis

Lightdash versions prior to 0.510.3 contain a path traversal vulnerability (CWE-22) in the file-handling endpoints located in packages/backend/src/routers. The affected routers accept requests that include .. sequences and fail to enforce that only the intended .csv or .png extensions are served, allowing unauthorized access to files outside the designated directories. The issue carries a CVSS 3.1 score of 7.5 reflecting network attackability without authentication or user interaction.

An unauthenticated remote attacker can send crafted requests to these endpoints and retrieve arbitrary files from the server filesystem, resulting in disclosure of sensitive data with high confidentiality impact. No privileges are required, and the attack can be performed directly over the network.

Public references, including the Lightdash GitHub commit fcc808c, the 0.510.2-to-0.510.3 diff, and pull request 5090, document the corrective changes that close the traversal vectors and enforce extension checks. The associated advisory at advisory.dw1.io/59 recommends upgrading to version 0.510.3 or later. The EPSS score remains elevated near 0.92 with no material rise from a low baseline.