Tkfiles
Monthly
Arbitrary file read in the Takes web framework's TkFiles take (through version 2.0-SNAPSHOT) lets remote, unauthenticated attackers escape the configured file-serving base directory by inserting ../ sequences into the HTTP request path, disclosing files readable by the Java process. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication or user interaction is needed, and the impact is limited to confidentiality with no integrity or availability effect; the practical blast radius depends on how permissive the hosting process's OS-level file permissions are. Exploitation is straightforward for any internet-reachable TkFiles-backed endpoint, and publicly available exploit code exists (a detailed proof-of-concept report is linked from the NVD entry), but there is no indication of confirmed active exploitation in the wild and no CISA KEV listing.
Arbitrary file read in the Takes web framework's TkFiles take (through version 2.0-SNAPSHOT) lets remote, unauthenticated attackers escape the configured file-serving base directory by inserting ../ sequences into the HTTP request path, disclosing files readable by the Java process. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication or user interaction is needed, and the impact is limited to confidentiality with no integrity or availability effect; the practical blast radius depends on how permissive the hosting process's OS-level file permissions are. Exploitation is straightforward for any internet-reachable TkFiles-backed endpoint, and publicly available exploit code exists (a detailed proof-of-concept report is linked from the NVD entry), but there is no indication of confirmed active exploitation in the wild and no CISA KEV listing.