Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
Impact
If an admin account has already been compromised by an attacker, the LESS parser can be exploited to read sensitive files on the server through the use of path traversal techniques.
An attacker can achieve this by providing an absolute path to a sensitive file in the custom LESS setting, which the LESS parser will then read. For example, an attacker could use the following code to read the contents of the /etc/passwd file:
@import (inline) '/etc/passwd';
.test {
content: data-uri('/etc/passwd');
}Patches
The vulnerability has been addressed in version 1.7. Users should upgrade to this version to mitigate the vulnerability.
Workarounds
Users can mitigate the vulnerability by ensuring that their admin accounts are secured with strong passwords and other best practices for account security. Additionally, users can limit the exposure of sensitive files on the server by implementing appropriate file permissions and access controls.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | flarum/core | < 1.7.0 | 1.7.0 |
Referencias
- https://github.com/flarum/framework/security/advisories/GHSA-vhm8-wwrf-3gcw
- https://nvd.nist.gov/vuln/detail/CVE-2023-27577
- https://github.com/flarum/framework/commit/1761660c98ea5a3e9665fb8e6041d1f2ee62a444
- https://github.com/flarum/flarum-core
- https://github.com/flarum/flarum-core/releases/tag/v1.7.0
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H- Debilidad (CWE)
CWE-22- Plataforma
- Composer
- Paquete
flarum/core- Publicada
- 13.03.2023
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-vhm8-wwrf-3gcw - CC BY 4.0
Historial de vulnerabilidades: flarum/core
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 9
- Primera → última
- 06.2021 04.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 2
- Alta 1
- Media 5
- Baja 1
Divulgaciones por año
- 2021: 1
- 2022: 1
- 2023: 4
- 2024: 1
- 2025: 1
- 2026: 1
-
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.