Executive brief
stattic is a static site generator commonly used for building web projects. Versions prior to 0.3.0 contain a path traversal flaw that allows remote attackers to read arbitrary files from the server without authentication. An attacker can exploit this to access sensitive configuration files, credentials, source code, or other confidential data.
Technical details
This vulnerability is a classic path traversal (CWE-22) issue in stattic versions before 0.3.0. The flaw allows remote attackers to craft requests using directory traversal sequences (e.g., `../`) to escape intended directory restrictions and read arbitrary files with any extension from the host system. No authentication or user interaction is required; the attack is network-accessible. An attacker can enumerate and retrieve sensitive files to gather intelligence for further attacks. The fix is to update to version 0.3.0 or later.
Affected products
- stattic stattic < 0.3.0
Timeline
- 2018-05-29: disclosed
- 2018-07-18: advisory
- 2018: patched: Version 0.3.0 released