Executive brief
Starlette is a popular toolkit used to build web applications and APIs, including the FastAPI framework. In versions prior to 1.1.0 running on Windows, an attacker can trick the server into connecting to a malicious remote file share. This allows the attacker to capture the server's login credentials (NTLMv2 hashes), which can be used to impersonate the service or gain further access to the corporate network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Starlette's StaticFiles component when running on Windows. The root cause is the use of `os.path.realpath` on user-supplied paths. When a UNC path (e.g., `\\attacker.com\share`) is provided, `os.path.join` in `lookup_path()` discards the intended base directory, and `os.path.realpath` subsequently initiates an outbound SMB connection to resolve the path. This occurs before any path containment checks are performed. An unauthenticated remote attacker can trigger this behavior to capture NTLMv2 hashes for offline cracking or relay attacks. The issue only affects Windows deployments where `follow_symlink` is set to False (the default). It is fixed in version 1.1.0 by rejecting paths starting with forward or backslashes.
Affected products
- Kludex starlette < 1.1.0
Timeline
- 2026-05-23: patched: Fix merged in PR #3287 and released in v1.1.0
- 2026-06-17: disclosed: CVE-2026-48818 published