Executive brief
Litestar and Starlite vulnerable to Path Traversal
Affected products
- PyPI litestar
- PyPI starlite
Junglewise Threat Intelligence
CVE-2024-32982: PYSEC-2026-2605 - Litestar and Starlite vulnerable to Path Traversal
CVE-2024-32982 · Severity: low · CVSS 3.1 · Published 2026-07-13
Technologies: litestar (PyPI), starlite (PyPI). Vendors: PyPI.
Related threats
- Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts
- Litestar XSS via CSRF token injection in templates
- PYSEC-2026-1553 - Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
- PYSEC-2026-1944 - Litestar allows unbounded resource consumption (DoS vulnerability)
- PYSEC-2026-2197 - Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode