CVE-2023-36827High· 7.5▾ Twilightethyca-fides Webserver API Path Traversal vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.5%
A path traversal (directory traversal) vulnerability affects fides versions lower than 2.15.1, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem.
The vulnerability is patched in fides 2.15.1. Users should upgrade to this version.
If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's security best practice documentation, and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error.
Additionally, any secrets supplied to the container using environment variables rather than a fides.toml configuration file are not affected by this vulnerability.
ethyca-fides < 2.15.1Upgrade to a patched release:
ethyca-fides 2.15.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42303MediumEthyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
CVE-2026-44541Highethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
CVE-2024-52008Medium· 5.7Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
CVE-2025-57766Medium· 4.8Fides' Admin UI User Password Change Does Not Invalidate Current Session
CVE-2023-46125Medium· 6.5Fides Information Disclosure Vulnerability in Config API Endpoint
CVE-2024-35189Medium· 6.5Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints