← All advisories

High severity7.5NVD Advisory· Published Nov 16, 2023· Updated Jun 17, 2026

CVE-2023-6020

CVE-2023-6020

Description

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
rayPyPI	< 2.8.1	2.8.1

Affected products

2

ghsa-coords
pkg:pypi/ray
Range: < 2.8.1
ray-project/ray-project/rayv5
Range: unspecified

Patches

Vulnerability mechanics

References

5

huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6nvdExploitWEB
github.com/advisories/GHSA-6cxr-8q3m-jwrrghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-6020ghsaADVISORY
github.com/ray-project/ray/releases/tag/ray-2.8.1ghsaWEB
www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023ghsaWEB

News mentions

0

No linked articles in our index yet.