---
id: CVE-2023-36827
aliases:
  - GHSA-r25m-cr6v-p9hq
  - PYSEC-2023-107
title: ethyca-fides Webserver API Path Traversal vulnerability
summary: ethyca-fides Webserver API Path Traversal vulnerability
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: ethyca-fides
product: ethyca-fides
ecosystem: pip
affected:
  - ethyca-fides < 2.15.1
patched:
  - ethyca-fides 2.15.1
published: '2023-07-06'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:02.581542539Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-r25m-cr6v-p9hq'
references:
  - url: 'https://github.com/ethyca/fides/security/advisories/GHSA-r25m-cr6v-p9hq'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-36827'
  - url: >-
      https://github.com/ethyca/fides/commit/f526d9ffb176006d701493c9d0eff6b4884e811f
  - url: 'https://github.com/ethyca/fides'
  - url: 'https://github.com/ethyca/fides/releases/tag/2.15.1'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/ethyca-fides/PYSEC-2023-107.yaml
tags:
  - osv
  - pip
epss: 0.01491
epssPercentile: 0.72991
ingestedAt: '2026-09-12T03:13:01.724Z'
---

## Overview

### Impact
A path traversal (directory traversal) vulnerability affects fides versions lower than `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem.

### Patches
The vulnerability is patched in fides `2.15.1`. Users should upgrade to this version.

### Workarounds
If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's [security best practice documentation](https://docs.ethyca.com/docs/configuration/security-practices#reverse-proxy), and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error.

Additionally, any secrets supplied to the container using environment variables rather than a `fides.toml` configuration file are not affected by this vulnerability.


## Affected packages

- `ethyca-fides < 2.15.1`

## Remediation

Upgrade to a patched release:

- `ethyca-fides 2.15.1`