High severity7.5NVD Advisory· Published Jun 19, 2023· Updated Jun 17, 2026

CVE-2023-35844

Description

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lightdash/Lightdash3 versions
cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*range: <0.510.3
- (no CPE)
- (no CPE)range: <0.510.3

Patches

Vulnerability mechanics

References

github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553cnvdPatch
github.com/lightdash/lightdash/pull/5090nvdPatch
advisory.dw1.io/59nvdExploitThird Party Advisory
github.com/lightdash/lightdash/compare/0.510.2...0.510.3nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000