CVE-2023-51232: Dagster vulnerable to Path Traversal attack through its /logs endpoint

July 7, 2025 (updated July 8, 2025)

Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.10 allows remote attackers to obtain sensitive information via crafted request to the /logs endpoint. This may be restricted to certain file names that start with a dot (’.’).

References

github.com/advisories/GHSA-q93c-p2mw-p23f
github.com/dagster-io/dagster
github.com/dagster-io/dagster/commit/dbb064c2ddda74265b8174edd9775e1302ca6ba0
github.com/dagster-io/dagster/pull/18462
nvd.nist.gov/vuln/detail/CVE-2023-51232

Code Behaviors & Features

Detect and mitigate CVE-2023-51232 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →