CVE-2023-27588

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22 CWE-27

Affected software

Vendor	Product	Versions
hasura	graphql-engine	< 1.3.4; >= 2.0.0, < 2.11.5; >= 2.2.0, < 2.20.1

References

https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158Patch
https://github.com/hasura/graphql-engine/releases/tag/v1.3.4Release Notes
https://github.com/hasura/graphql-engine/releases/tag/v2.11.5Release Notes
https://github.com/hasura/graphql-engine/releases/tag/v2.20.1Release Notes
https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1Release Notes
https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4xVendor Advisory
https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158Patch
https://github.com/hasura/graphql-engine/releases/tag/v1.3.4Release Notes
https://github.com/hasura/graphql-engine/releases/tag/v2.11.5Release Notes
https://github.com/hasura/graphql-engine/releases/tag/v2.20.1Release Notes
https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1Release Notes
https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4xVendor Advisory

Timeline

Published: Mar 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-275896.5Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a use CVE-2023-27598.8A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords o CVE-2023-275907.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. In version 0.5.1 and prior, converting a GDB registers profile CVE-2023-275917.5Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Minifl CVE-2023-275925.4Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When CVE-2023-275935.5Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an CVE-2023-275947.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, un CVE-2023-275959.8Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In version 1.13.0, when Cilium is started, there CVE-2023-275967.5OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed CVE-2023-275977.5OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP messa CVE-2023-275987.5OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header t CVE-2023-275997.5OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` hand