{"id":"CVE-2023-36827","aliases":["GHSA-r25m-cr6v-p9hq","PYSEC-2023-107"],"title":"ethyca-fides Webserver API Path Traversal vulnerability","summary":"ethyca-fides Webserver API Path Traversal vulnerability","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"ethyca-fides","product":"ethyca-fides","ecosystem":"pip","affected":["ethyca-fides < 2.15.1"],"patched":["ethyca-fides 2.15.1"],"published":"2023-07-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:02.581542539Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-r25m-cr6v-p9hq","references":[{"url":"https://github.com/ethyca/fides/security/advisories/GHSA-r25m-cr6v-p9hq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36827"},{"url":"https://github.com/ethyca/fides/commit/f526d9ffb176006d701493c9d0eff6b4884e811f"},{"url":"https://github.com/ethyca/fides"},{"url":"https://github.com/ethyca/fides/releases/tag/2.15.1"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ethyca-fides/PYSEC-2023-107.yaml"}],"tags":["osv","pip"],"epss":0.01491,"epssPercentile":0.72983,"ingestedAt":"2026-09-12T03:13:01.724Z","slug":"CVE-2023-36827","body":"## Overview\n\n### Impact\nA path traversal (directory traversal) vulnerability affects fides versions lower than `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem.\n\n### Patches\nThe vulnerability is patched in fides `2.15.1`. Users should upgrade to this version.\n\n### Workarounds\nIf the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's [security best practice documentation](https://docs.ethyca.com/docs/configuration/security-practices#reverse-proxy), and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error.\n\nAdditionally, any secrets supplied to the container using environment variables rather than a `fides.toml` configuration file are not affected by this vulnerability.\n\n\n## Affected packages\n\n- `ethyca-fides < 2.15.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ethyca-fides 2.15.1`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}