CVE-2024-39903

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
widgetti	solara	< 1.35.1
widgetti	solara	< 1.35.1

References

Timeline

Published: Jul 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-399048.8VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbi CVE-2024-399055.3Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permis CVE-2024-399068.3A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affect CVE-2024-399079.81Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well fil CVE-2024-399084.3REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific chara CVE-2024-399096.5KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesyst CVE-2024-39915.4The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i CVE-2024-399104.8decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG ed CVE-2024-399119.81Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issu CVE-2024-399125.3web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mecha CVE-2024-399149.8FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was CVE-2024-399159.9Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in T