Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-50265: Bazarr Arbitrary file read in /api/swaggerui/static endpoint
CVE-2023-50265 · published 2 years ago
Summary
Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.
What to do
- Update bazarr bazarr to version 1.3.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| bazarr | bazarr |
< 1.3.1 cpe:2.3:a:bazarr:bazarr:*:*:*:*:*:*:*:* |
Original advisory text
Bazarr Arbitrary file read in /api/swaggerui/static endpoint
Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50265... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-50265 Vendor Advisory
- https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1 URL
- https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/ Vendor Advisory
- https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46... Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published15 Dec 2023
Updated3 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta