Executive brief
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
Affected products
- PyPI starlette
Junglewise Threat Intelligence
CVE-2023-29159: PYSEC-2023-83 - Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to vie
CVE-2023-29159 · Severity: low · CVSS 3.1 · Published 2023-06-01
Technologies: starlette (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1942 - Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
- PYSEC-2026-1941 - Starlette has possible denial-of-service vector when parsing large files in multipart forms
- PYSEC-2026-1943 - Starlette Denial of service (DoS) via multipart/form-data
- Starlette denial of service via resource limit bypass in request.form
- Kludex Starlette hostname spoofing via unvalidated request path