4 matches found
CVE-2023-50265
Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...
CVE-2023-50265 Bazarr Arbitrary file read in /api/swaggerui/static endpoint
Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...
CVE-2023-50265
Bazarr prior to 1.3.1 contains an arbitrary file read in /api/swaggerui/static because the user‑supplied filename is passed to send_file in bazarr/app/ui.py without validation. Affects Bazarr versions before 1.3.1; fixed in 1.3.1. Impact: potential read of arbitrary files on the server. Remediati...
CVE-2023-50265 Bazarr Arbitrary file read in /api/swaggerui/static endpoint
Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...