CVE-2020-36939: Cassandra Web directory traversal remote file read

Executive brief

Cassandra Web is a web-based management interface for Apache Cassandra databases. Versions 0.5.0 and earlier contain a path traversal vulnerability that allows unauthenticated attackers to read any file on the system, including sensitive configuration files and database credentials. An attacker can exploit this over the network without authentication or user interaction to access system files like /etc/passwd and retrieve Cassandra database credentials.

Technical details

Cassandra Web 0.5.0 suffers from a path traversal vulnerability (CWE-22) due to improper pathname validation and a disabled Rack::Protection security module. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by crafting malicious path parameters that traverse the file system. The attack vector is network-based with low complexity and requires no authentication or user interaction. An attacker can retrieve sensitive files such as /etc/passwd and Apache Cassandra database credentials from any accessible filesystem location. As of the advisory publication, no patched version has been released for cassandra-web.

Affected products

• avalanche123 cassandra-web <= 0.5.0

Timeline

• 2026-01-27: disclosed
• 2026-01-27: advisory: Published by GitHub Advisory Database and NVD

References

• https://api.github.com/users/simi
• https://github.com/simi
• https://api.github.com/users/simi/gists%7B/gist_id%7D
• https://api.github.com/users/simi/repos
• https://avatars.githubusercontent.com/u/193936?v=4
• https://api.github.com/users/simi/events%7B/privacy%7D