---
id: CVE-2024-7340
aliases:
  - GHSA-r49h-6qxq-624f
  - PYSEC-2026-2035
title: Weave server API vulnerable to arbitrary file leak
summary: Weave server API vulnerable to arbitrary file leak
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: weave
product: weave
ecosystem: pip
affected:
  - weave < 0.50.8
patched:
  - weave 0.50.8
published: '2024-07-31'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-r49h-6qxq-624f'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-7340'
  - url: 'https://github.com/wandb/weave/pull/1657'
  - url: >-
      https://github.com/wandb/weave/commit/f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f
  - url: 'https://github.com/wandb/weave'
  - url: >-
      https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248
tags:
  - osv
  - pip
  - exploit-available
epss: 0.05015
epssPercentile: 0.91866
ingestedAt: '2026-07-08T18:25:52.641Z'
exploits:
  nuclei:
    - CVE-2024-7340
  checkedAt: '2026-09-23T07:13:30.858Z'
exploitAvailable: true
---

## Overview

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

## Affected packages

- `weave < 0.50.8`

## Remediation

Upgrade to a patched release:

- `weave 0.50.8`