CVE-2022-35918 is a path traversal vulnerability affecting Streamlit, a popular Python-based framework used for developing data-oriented web applications. The vulnerability exists in versions of Streamlit from 0.63.0 up to but not including 1.11.1. Streamlit applications that utilize custom components are susceptible to this flaw. An attacker can exploit this vulnerability by crafting a malicious URL containing specially constructed file paths. When the Streamlit server processes such a URL, it fails to properly restrict pathname resolution to a safe directory, allowing the attacker to traverse directories outside the intended scope. This can lead to unauthorized disclosure of sensitive files on the server’s filesystem, including server logs, world-readable files, and potentially other confidential data. The vulnerability arises from improper limitation of pathname inputs (CWE-22), which is a common security weakness related to insufficient validation of user-supplied file paths. No authentication or user interaction is required to exploit this vulnerability, making it accessible to remote unauthenticated attackers. The issue was publicly disclosed on August 1, 2022, and has been resolved in Streamlit version 1.11.1. There are no known workarounds, so upgrading to the patched version is the recommended remediation. No known exploits have been observed in the wild to date, but the nature of the vulnerability means it could be leveraged for reconnaissance or data exfiltration if left unpatched.

For European organizations using Streamlit to host data-driven applications, this vulnerability poses a significant risk to confidentiality. Attackers could access sensitive internal files, including logs that may contain personally identifiable information (PII), configuration files with credentials, or other proprietary data. This could lead to data breaches, regulatory non-compliance (e.g., GDPR violations), reputational damage, and potential financial penalties. The integrity and availability of the Streamlit service are less directly impacted, but disclosure of sensitive information could facilitate further attacks such as privilege escalation or lateral movement within the network. Organizations in sectors with high data sensitivity—such as finance, healthcare, research institutions, and government agencies—are particularly at risk. Since exploitation requires no authentication or user interaction, the attack surface is broad, especially for publicly accessible Streamlit applications. The lack of known exploits in the wild reduces immediate urgency but does not diminish the potential impact if exploited.

The primary and only effective mitigation is to upgrade all Streamlit instances to version 1.11.1 or later, where this vulnerability has been patched. Organizations should conduct an inventory of all Streamlit deployments, including development, staging, and production environments, to ensure no vulnerable versions remain in use. Additionally, organizations should implement strict network segmentation and firewall rules to limit external access to Streamlit servers, especially if they host sensitive data or internal applications. Monitoring HTTP request logs for suspicious URL patterns that attempt directory traversal sequences (e.g., '../') can help detect attempted exploitation. Employing Web Application Firewalls (WAFs) with custom rules to block path traversal attempts targeting Streamlit endpoints can provide an additional layer of defense. Finally, organizations should review file permissions on the server to minimize exposure of sensitive files and ensure that only necessary files are world-readable. Regular security assessments and penetration testing focusing on web application vulnerabilities should include checks for path traversal issues.