# Streamlit path traversal in custom components static file handler

Source: https://junglewise.ai/threats/streamlit-path-traversal-in-custom-components-static-file-handler-e6d7fa2a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-12. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.3 · Published 2024-01-12

Streamlit, a framework for building data science web applications, contains a security flaw in how it handles custom components. An attacker could potentially access sensitive files on the server hosting the application, such as logs or system configuration files. This issue is a regression or incomplete fix for a previously identified directory traversal vulnerability.

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.3, published 12 January 2024.

**Which products and versions are affected?** Streamlit >= 0.63.0, < 1.30.0.

**Is there a fix for This vulnerability?** A patch was published on 2024-01-11: Fixed in version 1.30.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Streamlit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Streamlit is vulnerable to a directory traversal attack (CWE-22) due to an incomplete fix for a previous vulnerability. The flaw exists in the component request handler and static file handler where path validation was insufficient. Specifically, the application used a common prefix check rather than a proper common path check, which could be bypassed under specific conditions to access files outside the intended directory. An attacker can exploit this by crafting malicious URLs to request files from the server's filesystem. The vulnerability was fully addressed in version 1.30.0 by switching to 'commonpath' for path validation.

## Affected products

- Streamlit streamlit >= 0.63.0, < 1.30.0

## Timeline

- 2022-07-28: disclosed: Initial vulnerability CVE-2022-35918 disclosed
- 2024-01-11: advisory: GHSA-8qw9-gf7w-42x5 published regarding the incomplete fix
- 2024-01-11: patched: Fixed in version 1.30.0

## References

- [https://github.com/streamlit/streamlit/security/advisories/GHSA-8qw9-gf7w-42x5](https://github.com/streamlit/streamlit/security/advisories/GHSA-8qw9-gf7w-42x5)
- [https://github.com/streamlit/streamlit/commit/bd0a8996c4c7ec55b9c6557e7b168b0c13a25b90](https://github.com/streamlit/streamlit/commit/bd0a8996c4c7ec55b9c6557e7b168b0c13a25b90)
- [https://www.cve.org/CVERecord?id=CVE-2022-35918](https://www.cve.org/CVERecord?id=CVE-2022-35918)
- [https://api.github.com/repos/streamlit/streamlit/security-advisories/GHSA-8qw9-gf7w-42x5](https://api.github.com/repos/streamlit/streamlit/security-advisories/GHSA-8qw9-gf7w-42x5)

## Related threats

- [Streamlit weak hash in caching component](https://junglewise.ai/threats/cve-2026-10804-streamlit-weak-hash-in-caching-component)