Vulnerability · Published Jan 27, 2026 · Assigned by VulnCheck

CVE-2020-36939Cassandra Web 0.5.0 - Remote File Read

High 7.5

In plain English

A high-severity path traversal in Cassandra Web from avalanche123. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)3.0%top 12.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Metasploit

Official description

Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files like /etc/passwd and retrieve Apache Cassandra database credentials.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
RubyGems	cassandra-web	no fix listed	GHSA-8mfv-xhp5-48q9

Affected products (as reported)

Vendor	Product	Versions
avalanche123	Cassandra Web	0.5.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ExploitDB-49362 exploit
Cassandra Web GitHub Repository product
Cassandra Web RubyGems Package product
VulnCheck Advisory: Cassandra Web 0.5.0 - Remote File Read third-party-advisory