# CVE-2023-7079: Cloudflare Wrangler dev server arbitrary file read

Source: https://junglewise.ai/threats/cve-2023-7079-cloudflare-wrangler-dev-server-arbitrary-file-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-7079 · Severity: low · CVSS 3.1 · Published 2024-01-03

Wrangler is a development tool used by engineers to build and test Cloudflare Workers applications locally. A flaw in its dev server could allow an attacker on the local network—or someone who tricks a user into visiting a malicious website—to read any file on that user's computer. This could expose source code, credentials, configuration files, and other sensitive data stored locally.

Technologies: [wrangler (npm)](https://junglewise.ai/threats/technologies/wrangler). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-7079 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-7079 being exploited in the wild.

**How severe is CVE-2023-7079?** Low severity, with a CVSS score of 3.1, published 3 January 2024.

**Which products and versions are affected?** wrangler (npm) SEMVER:introduced=3.9.0,fixed=3.19.0.

**Is there a fix for CVE-2023-7079?** Yes. wrangler (npm): upgrade to 3.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-7079 attacked?** It is attacked from the adjacent network or over the network.

**Am I affected by CVE-2023-7079?** Check whether you run wrangler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wrangler (npm): upgrade to 3.19.0 or later

  ```sh
  npm install wrangler@3.19.0
  ```


## Technical details

The vulnerability is an improper access control issue (CWE-287) in Wrangler's dev server that fails to restrict which files can be served over HTTP. By sending specially crafted HTTP requests and inspector protocol messages, an attacker can read arbitrary files on the host system, bypassing the intended bundle-based access restrictions. The attack vector is adjacent network (AV:A) with high attack complexity (AC:H), requiring the attacker to be on the local network or trick a user into visiting a malicious website. The vulnerability affects versions 3.9.0 through 3.18.x and was patched in version 3.19.0, which now serves only files within the bundle or referenced by source maps. A partial workaround exists by configuring Wrangler to listen only on 127.0.0.1.

## Affected products

- Cloudflare Wrangler 3.9.0 to 3.18.x

## Identifiers

- CVE-2023-7079
- GHSA-cfph-4qqh-w828

## Timeline

- 2023-12-29: disclosed
- 2024-01-03: patched: Fixed in wrangler@3.19.0

## References

- [https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828](https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828)

## Related threats

- [Cloudflare Wrangler OS command injection in pages deploy](https://junglewise.ai/threats/cloudflare-wrangler-os-command-injection-in-pages-deploy-05ff18ee)
- [Cloudflare Wrangler arbitrary code execution in dev inspector](https://junglewise.ai/threats/cve-2023-7080-cloudflare-wrangler-arbitrary-code-execution-in-dev-inspector)
- [Cloudflare Wrangler directory traversal vulnerability](https://junglewise.ai/threats/cve-2023-3348-cloudflare-wrangler-directory-traversal-vulnerability)