Files or Directories Accessible to External Parties in scrapy - #VU127071
Published: May 14, 2024 / Updated: April 23, 2026
Vulnerability identifier: #VU127071
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-552
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper restriction of redirect targets in redirect handling when following redirects to non-http schemes. A remote user can define start requests that trigger redirects to file://, ftp://, or s3:// URLs to disclose sensitive information.
Exploitation requires write access to the spider start requests and read access to the spider output.
Affected software
scrapy
Remediation
Install security update from vendor's website.
scrapy - update to 2.11.2