CVE-2026-34783

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34783", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T19:54:55.556Z", "datePublished": "2026-04-06T16:04:24.959Z", "dateUpdated": "2026-04-07T14:12:22.159Z"}, "containers": {"cna": {"title": "Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j"}, {"name": "https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917", "tags": ["x_refsource_MISC"], "url": "https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917"}], "affected": [{"vendor": "MontFerret", "product": "ferret", "versions": [{"version": "< 2.0.0-alpha.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T16:04:24.959Z"}, "descriptions": [{"lang": "en", "value": "Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4."}], "source": {"advisory": "GHSA-j6v5-g24h-vg4j", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T14:12:17.493517Z", "id": "CVE-2026-34783", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:12:22.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34783", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T14:12:17.493517Z"}}}], "references": [{"url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:12:11.404Z"}}], "cna": {"title": "Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites", "source": {"advisory": "GHSA-j6v5-g24h-vg4j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "MontFerret", "product": "ferret", "versions": [{"status": "affected", "version": "< 2.0.0-alpha.4"}]}], "references": [{"url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j", "name": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917", "name": "https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T16:04:24.959Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34783", "state": "PUBLISHED", "dateUpdated": "2026-04-07T14:12:22.159Z", "dateReserved": "2026-03-30T19:54:55.556Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T16:04:24.959Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ferret", "vendor": "MontFerret", "versions": [{"status": "affected", "version": "< 2.0.0-alpha.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:montferret:ferret:*:*:*:*:*:go:*:*", "matchCriteriaId": "5ABE84D9-EFCF-4AEF-8A0A-CB71C1F25069", "versionEndExcluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:montferret:ferret:2.0.0:alpha1:*:*:*:go:*:*", "matchCriteriaId": "210E958B-0BF8-4176-9D5F-B0C830B43E95", "vulnerable": true}, {"criteria": "cpe:2.3:a:montferret:ferret:2.0.0:alpha2:*:*:*:go:*:*", "matchCriteriaId": "BABC4531-C6A0-4B56-9CB4-6EAE7ED01696", "vulnerable": true}, {"criteria": "cpe:2.3:a:montferret:ferret:2.0.0:alpha3:*:*:*:go:*:*", "matchCriteriaId": "24AD5875-C977-47CE-BE8F-3CCC4BF07045", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4."}, {"lang": "es", "value": "pendiente..."}], "id": "CVE-2026-34783", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34783", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T14:12:17.493517Z", "version": "2.0.3"}}]}, "published": "2026-04-06T17:17:10.430", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.0-alpha.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ferret", "source": "cna", "vendor": "MontFerret"}, "product": "ferret", "vendor": "montferret"}], "analysis": {"en": {"generated_at": "2026-04-14T21:46:38.447228+00:00", "value": {"mitigation_remediation": ["Upgrade to Ferret 2.0.0\u2011alpha.4 or later to apply the vendor patch", "If upgrading immediately is not possible, cherry\u2011pick the commit that contains the fix (160ebad6bd50f153453e120f6d909f5b83322917) and rebuild the application", "Configure Ferret to sanitize or restrict filenames used in IO::FS::WRITE by rejecting paths containing \"../\" or by enforcing a safe base directory", "In the interim, monitor the filesystem for unexpected file writes or modifications made by Ferret processes", "Validate your environment for any previously injected malicious files and remove them promptly"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects every installation of MontFerret Ferret up to the 2.0.0\u2011alpha.3 release. Any deployment running version 2.0.0\u2011alpha.3 or earlier is subject to the flaw, while 2.0.0\u2011alpha.4 and newer contain the fix. Specific affected CPEs include montferret:ferret with any minor version prior to alpha.4.", "description_and_impact": "This vulnerability is a classic path traversal flaw that enables an attacker to write arbitrary files to the host system when a Ferret operator scrapes a website. Because the IO::FS::WRITE function accepts filenames supplied by the site, a malicious site can embed \"../\" sequences in its returned filenames. The attacker consequently controls both the target path and the content of the written file, allowing deployment of cron jobs, SSH authorized_keys, shell profiles or web shells that can execute code with the Ferret process privilege. The weakness is reflected in CWE-22 (Path Traversal) and CWE-73 (OS Command Injection via Untrusted File Name). ", "risk_and_exploitability": "The CVSS score of 8.1 categorizes this as a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently rare or unverified, and the vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, the likely attack vector is an operator who unknowingly scrapes a malicious site; the attacker would host a site that returns filenames with directory traversal sequences, causing Ferret to write files to arbitrary locations on the host machine. The vulnerability is exploitable with standard web scraping workflows, and no additional privileged access appears required beyond running Ferret."}}}}, "created": "2026-04-06T20:13:49.592105+00:00", "updated": "2026-04-15T16:30:09.741953+00:00", "vendors": ["montferret", "montferret$PRODUCT$ferret"]}