Log in Start free

Vulnerability · Published Apr 3, 2024 · Assigned by GitHub_M

CVE-2024-30265Voilà Local file inclusion

High 7.5

In plain English

A high-severity security flaw in voila from voila-dashboards. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 45.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIvoila0.2.17GHSA-2q59-h24c-w6fg
PyPIvoila0.3.8GHSA-2q59-h24c-w6fg
PyPIvoila0.4.4GHSA-2q59-h24c-w6fg
PyPIvoila0.5.6GHSA-2q59-h24c-w6fg
PyPIvoila0.2.17, 0.3.8, 0.4.4, 0.5.6PYSEC-2026-2027

Affected products (as reported)

VendorProductVersions
voila-dashboards voila >= 0.0.2, < 0.2.17>= 0.3.0a0, < 0.3.8>= 0.4.0a0, < 0.4.4>= 0.5.0a0, < 0.5.6

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References