# CVE-2023-3348: Cloudflare Wrangler directory traversal vulnerability

Source: https://junglewise.ai/threats/cve-2023-3348-cloudflare-wrangler-directory-traversal-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-08-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-3348 · Severity: low · CVSS 3.1 · Published 2023-08-03

Cloudflare Wrangler is a command-line tool used by developers to build and deploy serverless applications on Cloudflare Workers. An attacker on the same local network as a developer running the local development server could bypass directory restrictions and read files outside the intended project directory, potentially exposing sensitive source code, configuration files, or other confidential data.

Technologies: [wrangler (npm)](https://junglewise.ai/threats/technologies/wrangler). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-3348 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-3348 being exploited in the wild.

**How severe is CVE-2023-3348?** Low severity, with a CVSS score of 3.1, published 3 August 2023.

**Which products and versions are affected?** wrangler (npm) SEMVER:introduced=0,fixed=2.20.1.

**Is there a fix for CVE-2023-3348?** Yes. wrangler (npm): upgrade to 2.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-3348 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2023-3348?** Check whether you run wrangler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wrangler (npm): upgrade to 2.20.1 or later

  ```sh
  npm install wrangler@2.20.1
  ```


## Technical details

The vulnerability is a directory traversal (path traversal) flaw in Wrangler's local development server used by the `wrangler pages dev` command. An attacker on the same network (adjacent attack vector) can exploit this by crafting requests with path traversal sequences (e.g., ../) to escape the designated development directory and access arbitrary files on the developer's system. The vulnerability requires user interaction (the developer must have the local server running) but no special privileges or authentication. An attacker can achieve high confidentiality impact by reading sensitive files. The issue has been patched in Wrangler v2.20.1 and v3.1.1.

## Affected products

- Cloudflare Wrangler < 2.20.1 and < 3.1.1

## Identifiers

- CVE-2023-3348
- GHSA-8c93-4hch-xgxp

## Timeline

- 2023-08-03: disclosed
- 2023-08-03: patched: Fixed in Wrangler v2.20.1 and v3.1.1

## References

- [https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-8c93-4hch-xgxp](https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-8c93-4hch-xgxp)

## Related threats

- [Cloudflare Wrangler OS command injection in pages deploy](https://junglewise.ai/threats/cloudflare-wrangler-os-command-injection-in-pages-deploy-05ff18ee)
- [Cloudflare Wrangler arbitrary code execution in dev inspector](https://junglewise.ai/threats/cve-2023-7080-cloudflare-wrangler-arbitrary-code-execution-in-dev-inspector)
- [Cloudflare Wrangler dev server arbitrary file read](https://junglewise.ai/threats/cve-2023-7079-cloudflare-wrangler-dev-server-arbitrary-file-read)