CVE-2023-35844
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that a...
Original description
The description as published by the source.
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
References
- advisory advisory.dw1.io
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web github.com