---
id: CVE-2023-51232
aliases:
  - GHSA-q93c-p2mw-p23f
  - PYSEC-2026-1287
title: Dagster vulnerable to Path Traversal attack through its /logs endpoint
summary: Dagster vulnerable to Path Traversal attack through its /logs endpoint
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: dagster
product: dagster
ecosystem: pip
affected:
  - dagster < 1.5.11
patched:
  - dagster 1.5.11
published: '2025-07-07'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-q93c-p2mw-p23f'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-51232'
  - url: 'https://github.com/dagster-io/dagster/pull/18462'
  - url: >-
      https://github.com/dagster-io/dagster/commit/dbb064c2ddda74265b8174edd9775e1302ca6ba0
  - url: 'https://github.com/dagster-io/dagster'
tags:
  - osv
  - pip
epss: 0.00925
epssPercentile: 0.58967
ingestedAt: '2026-07-08T18:25:52.137Z'
---

## Overview

Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.10 allows remote attackers to obtain sensitive information via crafted request to the /logs endpoint. This may be restricted to certain file names that start with a dot ('.').

## Affected packages

- `dagster < 1.5.11`

## Remediation

Upgrade to a patched release:

- `dagster 1.5.11`